An Investigation Into Foreign 
Entities Who Are Targeting 
Servicemembers and Veterans 
Online 


MVE? 
S 
\y 


Pp 
v4 
” 
(||) 


) 
os 
Pa 





COVER IMAGE: Photo courtesy of Pixabay.com 


2 


An Investigation Into Foreign 
Entities Who Are Targeting 
Servicemembers and Veterans 

Online 





Prepared by 
Kristofer Goldsmith 


Chief Investigator 
Associate Director for Policy and Government Affairs 


for 


Vietnam Veterans of America 


TABLE OF CONTENTS 


54: 


68 


74 


108 


Executive Summary 

Introduction 

Approach 

Abbreviations 

Glossary 

Appendix 1: Facebook Primer 

Appendix 2: Foreign Admins’ Countries of Origin 
Author Biography 

Acknowledgments 

Endnotes 


The Investigation 


Chapter 1: The Imitation of Vietnam Veterans of America 

22 The First Bulgarian Entity: “Vietnam Vets of America’... 

33 The Broader Investigation Begins 

35 Unknown Origins: The Anti-Trump “Vietnam Veterans Advocacy Group” 


35 Unknown Origins: “Vietnam Vets Unite” 

36 International Effort to Sell Counterfeit VVA Merchandise... 
46 Fundraising Scams 

49 Snapchat 

51 Instagram 


Chapter 2: The Bulgarian and Russian Entity 
60 Creation of an Online Ecosystem... 


Chapter 3: Creation of Fake Veterans Organizations 
68 “We Are Veterans"... 


Chapter 4: The Content Used by Foreign Admins... 

74 Audience-Building Content 

77 Divisive Content 

77 Categories of MilVet Content 

77 Historical Photographs 

80 Use of Prominent Servicemembers: Marilyn Gabbard, Aaron Mankin, Kyle Carpenter, 
Kirstie Ennis, Chris Kyle 

80 Casket Photos 

87 Racist and Xenophobic Propaganda 

94, Antifa 

94, Obama vs. Trump... 

94, Elderly Veterans... 

94, Kaepernick and the NFL vs. Troops 

94, Exploiting KIAs, WIAs, and Mourning Servicemembers 

100 ~— Holidays 

100‘ Secretary Mattis Memes 

100 _~— Exploiting Military Women 

100 __— Exploiting Homeless Veterans 


Chapter 5: What We Know About the Russian Ads... 

108 =‘ Evaluating the IRA Ads 

108 ‘The Content Russia Has Already Used to Target MilVets... 

109 = Chart: Specifically Targeted Veterans Organizations 

110. ~=—s- Chart: Targeting Criteria 

111 Chart: Topics 

113 Russians Selling MilVet Merchandise 

113 Captain Luis Carlos Montalvan 

113 Indications of What MilVets Running for Office in 2020 Should Expect... 


116 


126 


14.2 


161 


162 


164 


166 
167 
170 
170 
171 
171 
171 


173 


TABLE OF CONTENTS 


Chapter 6: Identity Theft of MilVets to Engage in Financial Fraud and Espionage 

116 ‘The Yahoo Boys 

118 Chinese Espionage 

119 Spotting Fakes/Army Staff Sergeant Sherri Vlastuin 

119 Members of Congress With Military Backgrounds Used for Romance Scams 
122 Members of Congress With Military Backgrounds: Patrick J. Murphy 

124 Members of Congress With Military Backgrounds: Lee Zeldin, Adam Kinzinger 


Chapter 7: Facebook’s Switch to “Groups” and the Dangers of “Community”... 
180 ‘The Evolution of a Backup Group... 
187 “Veterans Nation” and “Veterans Nation — Honoring All Who Served” 


Chapter 8: First-Known 2020-Election Interference — Macedonians Steal and 

Promote “Vets for Trump,’ Facebook Fails to Respond to American Admins’ Pleas for Help 

146 = Attacks Against Politicians by Macedonians: Joe Biden, Elizabeth Warren, Kamala Harris, 
Bernie Sanders, Beto O’Rourke, Cory Booker, Kirsten Gillibrand 

152. ~=Arsov/usapoliticstoday 

158 Screenshots: Pro-Putin/Assange; Anti-Comey/FBI/Obama/Clinton/ 
Election Disinformation 

155 ~~ Pro-Putin/Pro-Assange/Anti-Comey/Anti-FBI 

155 Maligning Barack Obama and Hillary Clinton and Spreading Election Disinformation 

155  Fomenting Hate Against Democrats of Color: Alexandria Ocasio-Cortez, Ilhan Omar, 
Rashida Tlaib 


Chapter 9: Russian Hackers Make Terroristic Threats Against Military Families While 
Claiming to Be ISIS 


Chapter 10: Suspicious Accounts Purporting to Work for Reputable MilVet-Focused 
Organizations 
162. _~Fake Veterans Advantage Employee: “Richard Gordon” 


Conclusion 


Recommended Action 
White House 

Department of Veterans Affairs 
Department of Defense 
Department of State 
Department of Justice 
Congress 


Social-Media and Internet Companies 


EXECUTIVE SUMMARY 


Vietnam Veterans of America’s (VVA) two- 
year investigation, beginning in August 2017, 
has documented persistent, pervasive, and 
coordinated online targeting of American 
servicemembers, veterans, and their families 
by foreign entities who seek to disrupt 
American democracy. American veterans 
and the social-media followers of several 
congressionally chartered veterans service 
organizations were specifically targeted by 
the Russian Internet Research Agency with 
at least 118 ads during and after the 2016 
election. However, this represents but a tiny 
fraction of the Russian activity that targeted 
this community with divisive propaganda: 
The organic politically divisive content 
(organic meaning not having to do with ads, 
rather unpaid posts and comments) created 
by Russians have a far greater reach than 

the known paid ads; for even though many 
of the original sources have been removed 
from social-media platforms, their posts and 
comments continue to be propagated and 
disseminated by foreign administrators (aka 
admins, who maintain and manage online 
sites) to spread hateful and politically divisive 
messages. 


In 2018, Facebook released a tool to reveal 
the countries of origin of Facebook-page 
admins for pages that have more than 
110,000 followers or have purchased ads 

of a political nature. This tool has not 
inhibited the creation, rapid growth, and 
influence of foreign-born Facebook pages. 
This measure has, however, revealed that 
known Russian propaganda and similar 
politically divisive content that targets 
servicemembers and veterans is being spread 
by admins from at least 80 foreign countries, 
with concentrations in Eastern Europe and 
Vietnam. The tool has also revealed that 
these pages often have admins in multiple 
countries, including suspicious combinations 
of countries with native language barriers 
and no geographic commonalities: For 
example, the American-focused Facebook 
page “Veterans Nation” has spread Russian- 
generated content and had admins only 

in Vietnam, Brazil, and Ukraine. A second 
example is the “Honoring our American 
Heroes” Facebook page, which has four 
admins in the US, one in Indonesia, one in 
Iran, one in Malaysia, one in the Philippines, 
and one in Vietnam. This cross-border 


cooperation suggests an international 
conspiracy possibly related to and larger 
than the previously reported Russian 
disinformation campaign. 


Fake Veteran Accounts 


These foreign admins have created 
individual social-media accounts that 
purport to belong to American veterans 
working at reputable veterans organizations. 
They use these fake-veteran accounts to 

send friend requests to the relatively small 
community of veteran advocates and connect 
with its prominent members who work to 
shape federal policy. These fake-veteran 
accounts infiltrate both public Facebook 
pages and private Facebook groups, where 
they can spread propaganda and false news, 
while shaping and moderating/censoring 

the conversations of the unsuspecting 
community of American veterans who follow 
or join these groups and pages. These admins 
also recruit Americans who have an interest 
in veterans and other foreign nationals to 
help moderate the groups and pages and 
make them appear more legitimate. 


One such page, “Veterans of Vietnam, with 
nearly 160,000 followers, has had admins 

in Russia, Ukraine, and Italy. This page has 
been bolstered by at least three dedicated 
Russian-generated Vietnam-veteran- 
focused websites that were created to build 
the Facebook page's credibility by sharing 
information about the Vietnam War and 
veterans benefits. These admins also control 
a closed Facebook group, “American Veterans 
of Vietnam,’ which solicits information from 
Vietnam veterans regarding their military 
experience. 


Fake accounts are also being utilized by 
hostile Chinese intelligence services to 
connect with high-ranking and influential 
members of the intelligence and defense 
communities centered in and around 
Washington, DC. Chinese officials are seeking 
to exploit financially vulnerable members 

of these communities and leverage debts to 
recruit spies. 


Using Established Names 
and Logos 


Foreign admins have been using VVA’s logo 
and name, and the logos of several other 
congressionally chartered veterans service 
organizations (in addition to introducing 
almost identically named organizations: 
such as Vietnam Veterans of America 

versus Veterans of America), to establish 
influential social-media presences. These 
foreign admins then exploit the reputations 
of these established and legitimate veterans 
organizations to spread false, politically 
divisive, and hateful content while peddling 
counterfeit merchandise, both creating 
income for these criminal organizations and 
introducing inflammatory political content 
into the physical world from an online 
environment. 


Separately, individual Snapchat and 
Instagram accounts have been persistently 
using VVA’s name and logo to lure its 
supporters into participating in fraudulent 
fundraising. These foreign admins ask 
veterans to supply their personal banking 
information, claiming that if they solicit 
money by pretending to be doing fundraising 
for the VVA, they will then receive a share 
of the funds themselves, which will be 
deposited into their personal accounts. 


Identity Theft 


Foreign entities, primarily individuals from 
West Africa, have been stealing the identities 
of servicemembers and veterans, including 
those who have been killed in action, to 
target Americans with romance scams. 

The primary targets of these insidious and 
cruel scams are older, lonely Americans 
who are relatively new to social media 

and the internet. The ploy of posing as a 
servicemember or veteran for financial gain 
has serious consequences for both those 
whose identities are stolen and those who are 
duped into giving money. The FBI received 
nearly 18,500 complaints from victims 

of romance or similar internet scams last 
year, with reported losses exceeding $362 
million, up 71 percent from 2017, according 
to arecent article published by the New York 
Times. 
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Interference in Presidential 
Campaign 


VVA has discovered foreign entities targeting 
veterans for the purpose of interference in 
the 2020 presidential campaign. 


Admins from Macedonia and the United 
Kingdom controlled the page “Vets for 
Trump, from April 2019 to August 2019,” 
which has amassed over 181,000 followers. 
This page posts explicitly pro-Trump and 
anti-Democratic-candidate messages and 
memes. The page also posts pro-Russia/ 
Putin, pro-Assange/WikiLeaks, as well as 
anti-Robert-Mueller and anti-FBI content. 

In terms of anti-Democrat content, the page 
has been primarily focused on attacking 

the top Democratic presidential candidates: 
Vice President Joe Biden, Senator Elizabeth 
Warren, and Senator Bernie Sanders, while 
also going after Congressman Beto O’Rourke, 
Senator Kamala Harris, Senator Cory Booker, 
and Senator Kirsten Gillibrand. While 
previous reporting revealed in hearings held 
by committees such as the House Permanent 
Select Committee on Intelligence (HPSCI) 
have focused primarily on paid ads by 
foreign elements — the unpaid, organic posts 
and comments that appear on pages like this 
have mostly escaped scrutiny, despite the fact 
that they have far greater influence because 
of their tendency to be copied and shared. 


While under the control of foreign admins, 
“Vets for Trump” has also focused on 
fomenting hatred by using xenophobic 

and Islamophobic propaganda against 

the Democratic women of color who 

are freshmen in Congress. After creating 
incendiary posts about Representatives 
Ayanna Pressley, han Omar, Rashida Tlaib, 
and Alexandria Ocasio-Cortez, these foreign 
admins then connect them with propaganda 
to the 2020 Democratic candidates. These 
insidious tactics sow discord among 
Americans, providing fuel for conflict on a 
public forum between veterans sympathetic 
to the damaging, false message planted and 
Americans of other political persuasions. 


The foreign admins are skilled and 
sophisticated enough to operate undetected 
by not only laypersons but those in political 
life as well: Followers of the “Vets for Trump” 
page include at least one elected Republican 
official who was a campaign surrogate of the 


Trump campaign during the 2016 election, as 
well as an individual who was the inaugural 
chairman of a veteran-centric GOP PAC 
closely tied to the White House. 


This page had coordinated its behavior with 
a similarly named Facebook page, “Veterans 
for Donald Trump, with identical content 
that was frequently posted at the same time 
from a mobile phone through at least April 3, 
2019. Identical content was again posted on 
August 22. The “Veterans for Donald Trump” 
page currently has 14 domestic admins (with 
no foreign admins able to be seen). 


Combatting Foreign 
Predators 


Vietnam Veterans of America is presenting 
this report to the general public so that 
Americans and Congress can be aware of 
and have a better understanding of how 
these foreign admins operate. We are urging 
the White House, Congress, and the private 
sector to act quickly to combat this predatory 
behavior in cyber-environments and to 
ensure that the exploitation of and attacks 
against servicemembers, veterans, and our 
families do not go unpunished. 


Although social-media companies have 
been the primary focus of condemnation 
for these attacks against Americans — and 
they are absolutely responsible for their 
vulnerabilities — our citizens and the 
politicians who represent us must recognize 
that these attacks are by foreign enemies. 
While social-media companies, the US 
government, and the American public 
must make efforts to harden our current 
vulnerabilities, we must also prioritize the 
endeavor of disincentivizing attacks by 
punishing foreign adversaries. 


Recommended Action 


White House 


The White House must elevate American 
cybersecurity to the Cabinet level by 
Executive Order (EO), thereby prioritizing 
and centralizing our response and safeguards 
to risks from bad actors. A Director of 
Cybersecurity s role would be to ensure 

that American cybersecurity is a priority in 
every aspect of modern government. This 
EO should create a Civilian Cybersecurity 
Advisory Board consisting of Chief 

Internet Security Officers (CISOs) from 

the American companies that are the most 
important stakeholders in American internet 
infrastructure and cybersecurity. 


In recognition of the fact that military service 
results in increased likelihood of targeting by 
foreign adversaries, the EO should be used 

to appoint a Deputy Assistant Secretary of 
Cyber-Health at the Department of Veterans 
Affairs. The Deputy Assistant Secretary of 
Cyber-Health would report directly to the 
VA’s Under Secretary of Health and be 
charged with the responsibility of developing 
and prioritizing programs at the VA to 
improve cyber-hygiene — the practice of 
taking steps and the precautions necessary to 
keep data secure from outside attacks. 


The President should make permanent 

and expand the identity-theft insurance 

and credit-monitoring currently provided 

to victims of the Office of Personnel 
Management (OPM) data breach of 2015 

to include all servicemembers, veterans, 

and their families. The EO should also 
provide complimentary antivirus software to 
servicemembers, veterans, and their families, 
which would be a preventive measure against 
cybercrime and furthermore would reduce 
the reliance on programs that repair damage 
after a cybercrime has been committed. 


Department of Veterans Affairs 


The Secretary of Veterans Affairs should 
immediately develop plans to make the 
cyber-hygiene of veterans an urgent priority 
within the Department of Veterans Affairs. 
The VA must educate and train veterans 

on personal cybersecurity: how to mitigate 
vulnerabilities, vigilantly maintain safe 
practices, and recognize threats, including 


how to identify instances of online 
manipulation. 


Department of Defense 


The Secretary of Defense should create a 
working group to study the security risks 
inherent in the use of common personal 
electronic devices and apps at home 

and abroad by servicemembers. The 
Secretary must also direct commanders 
to include personal cybersecurity training 
and regular cyber-hygiene checks for all 
servicemembers. 


Department of State 


The Secretary of State should instruct 

the State Department to take all possible 
diplomatic efforts to ensure that countries 
around the world prioritize the apprehension 
of cybercriminals who target Americans. The 
Secretary should draft strong, diplomatic 
punitive measures against countries that 
shield or refuse to prosecute cybercriminals 
from their countries who target Americans. 


Department of Justice 


The Attorney General must ensure that 
companies that do business on the internet 
maintain evidence of and report all 
cybercrimes and propaganda campaigns 
suspected to have been committed against 
Americans by foreign entities. 


Congress 


Congress should update laws regarding 
internet privacy and fraud protection, in 
addition to granting federal law enforcement 
the jurisdiction to respond to and prevent 
cybercrimes. Congress should guarantee 
that law enforcement has the personnel 

and funding needed so that it can prioritize 
interdiction of networks of foreign 
cybercriminals who target Americans for 
financial fraud. It is essential to have laws that 
make certain all evidence of cybercrimes 
and foreign disinformation campaigns are 
preserved and that statutes of limitation 

are extended appropriately so that law 
enforcement and independent researchers 
can ensure that victims see their perpetrators 
brought to justice. 


EXECUTIVE SUMMARY 


Senate and House Committees on 
Veterans’ Affairs 


The Committees on Armed Services must 
commission studies to evaluate the risk to 
force readiness presented by cybercrime 
and foreign-born propaganda campaigns 
and determine how many servicemembers 
have already been impacted, as well as 

what security risks are presented by 
servicemembers’ use of personal devices 
and apps at home and abroad. The 
Committees should pass legislation to 

offer all servicemembers and their families 
complimentary antivirus software, in 
addition to make permanent the offer of 
lifetime credit-monitoring and identity-theft 
insurance. This legislation should instruct 
the Department of Defense (DoD) to make 
personal cyber-health a priority and require 
training of all servicemembers in cyber- 
hygiene. 


Social-Media and Internet Companies 


Social-media companies, including but 
not limited to Facebook, Instagram, and 
Twitter, must maintain all evidence of 
foreign interference for examination by law 
enforcement and independent researchers. 
If current laws or regulations prevent this, 
these companies should actively petition 
the government for the appropriate 
changes. Evidence approved for release 
should be watermarked, which will verify 
its authenticity, and maintained in public 
repository of known propaganda. 


Social-media companies should proactively 
and continually screen military and veterans 
groups and pages for inauthentic behavior. 
Furthermore, they should verify military 
service of those who claim it (especially 
LinkedIn) — use a “green” checkmark or 
verification badge, display a clear warning 
for claimed but unverified military status, 

or prohibit military/vet status from being 
claimed/Vvisible unless internally verified. 


In addition to screening military and 
veterans groups and pages, social-media 
companies should aggressively hunt for 
criminals using these platforms and report 
Suspicious activity to law enforcement rather 
than simply rely on reports submitted by 
users. 
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Social-media and internet companies must 
also empower reliable individuals and 
organizations with tools to assist them in 
discovering foreign “trolls” — those who 
deliberately post provocative, incendiary, or 
false content with the intent to cause harm. 
The “troll hunters” who produce reliable 
reporting should be well compensated. 


Facebook 


Include locations of all current and past 
admins in page history — and make the 
country of origin more prominent so that 
average uSers can see this information 
without a click-through. 


Scan for confirmed political propaganda 

of Russian/foreign origin using artificial 
intelligence (AJ) and notify users/pages; auto- 
watermark content to identify as propaganda 
from Russian/foreign source. 


Develop AI to detect romance scammers — 
zero in ON suspicious connections between 
military-afhliated West Africa and the United 
States, a common link. 


Twitter 
Seek out and verify legitimate veterans and 
veterans organizations who are engaged in 


politics and policy, and suspend predatory, 
false ones. 


LinkedIn 


Verify claimed military afhliations, and hide 
those that are unverified. 
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INTRODUCTION 


American servicemembers, veterans, and 
the organizations that represent them have 
been persistently targeted by hostile foreign 
entities in online environments for nefarious 
purposes. These entities include but are not 
limited to Russian intelligence services.? 
Their goals are to perpetrate financial fraud,* 
spread anti-American propaganda,’ and 
manipulate the online public community 
spaces and sow discord by exploiting and 
inflaming national divisions.®’ While their 
objectives also include election interference,° 
their activities and their effects continue 
without interruption year-round and are not 
limited to political elections. 


Vietnam Veterans of America (VVA), a 
congressionally chartered veterans service 
organization (VSO), has endured persistent 
and pervasive foreign-born online campaigns 
that have targeted our membership and 
organization since at least 2014. VVA first 
became aware of these cyberattacks in August 
2017 with the discovery of an impostor 
Facebook page using VVA's trademarked 
name and logo that was found to be linked to 
a suspicious Europe-based website. The page 
was spreading falsified news — changing 
dates on true stories and sensationalizing and 
exaggerating otherwise benign 

reporting — on issues that are closely 
associated with this specific population. 

Early results of VVA’s investigation were 
shared with various federal agencies and 
congressional committees in March and 
April 2018. This preliminary report identified 
an entity in Plovdiv, Bulgaria, as responsible 
for the creation of impostor social-media 
accounts meant to mislead Americans into 
believing that they represented VVA.° That 
analysis sparked an ongoing investigation, 
which has over the course of thousands 

of hours led to the discovery of foreign 
entities from at least 32 countries targeting 
members of the military and veterans 
(MilVets) community on social media by 
impersonating servicemembers and MilVets 
organizations. The list of host nations 
includes Russia and concentrations of 
countries in Eastern Europe and the Asian- 
Pacific. 


Foreign adversaries have many motivations 
for targeting members of the MilVets 
community. This population has a higher 
propensity than other subgroups of 
Americans who are politically 

engaged — they are more likely to vote and 
serve in public office — and they tend to 
wield greater political influence on those 
around them.'° Additionally, nearly one- 
third of the federal workforce is composed 
of veterans.!' This makes the targeting 

of the MilVets population a means to 
jeopardize federal agencies ranging from law 
enforcement and defense to healthcare and 
food safety. 


America’s adversaries focus on deceiving 
MilVets because they are particularly 
vulnerable to blackmail: Beyond the 
battlefield and long after they've taken off 
the uniform, MilVets who require security 
clearances can have their careers ended if 
their finances are compromised or if they are 
put in situations that leave them vulnerable. 


The data breach that was announced by 

the Office of Personnel Management 
(OPM) on June 4, 2015, became a valuable 
lesson in cybersecurity. Malware allegedly 
associated with a Chinese-government- 
sponsored “advanced persistent threat,’ 

or APT, known as Deep Panda obtained 

the background-investigation records of 
current, former, and prospective federal 
employees and contractors dating as far back 
as 2000. Twenty-two-million individuals 
had their personal data stolen. To put this 
into the context of the MilVets community, 
every servicemember whose military 
occupational specialty, rank, or position 
required a security clearance since before 
the Global War on Terror began had sensitive 
information such as their social-security 
numbers, address histories, and contact 
information stolen by a foreign government. 
Soon after the breach was publicized, OPM 
and the Department of Defense (DoD) 
announced a contract to provide temporary 
credit-monitoring and identity-theft 
insurance to victims of the breach. Congress 
then passed the Consolidated Appropriations 
Act of 2017 (Public Law No. 115-381). Section 
633 of that law requires OPM to provide 
complimentary insurance to these 22-million 
affected individuals from 2016-2026. 


Four years after the OPM data breach, the 
Justice Department filed charges alleging 
that some of that data had been used to 

take out fraudulent loans in the names of 
unsuspecting victims.!? This incident could 
be the first of many, particularly if the state- 
sponsored APT Deep Panda is selling the 
information on the dark web (the portion 
of the internet that allows users to remain 
untraceable). There remains the tremendous 
risk of APT Deep Panda coordinating with 
hostile non-state intelligence services, such 
as WikiLeaks, or hostile nation states in 

an attempt to disrupt the US government 
and population. If published publicly, this 
vast trove of information would cause 
serious personal damage to the 22-million 
affected Americans. The ripple effect of this 
vulnerability being exploited would cause 
incalculable social and economic harm to our 
country. 


While this threat of personal financial ruin 
hovers over the heads of millions of veterans, 
an even more disturbing hazard awaits 
troops on the battlefield at the intersection of 
cyber- and kinetic warfare, or cyber-kinetic 
warfare, in which enemy forces can detect 
and/or interfere with electronic devices 

and use them to cause harm. The Russian 
hacking unit known as APT 28, or Fancy 
Bear, has been known to use malware on 

the personal devices of Ukrainian troops 

to track their movements and ultimately 
target them with conventional weapons." 
Ukrainian troops and their families have 

also been targeted by Russia with “pinpoint 
propaganda’ messages sent via text. These 
messages aren't meant only to destroy 
morale. Texts sent to Ukrainian military 
families falsely announcing that their 
soldiers were killed in action cause panic, 
and Russians track the resulting surge in 
calls and mobile-phone signals from the 
families to the troops so that they can target 
the soldiers with conventional weapons.!® 
This insidious tactic could be similarly used 
against American troops in current conflict 
areas with information garnered from the 
OPM leak, as well as by using information 
easily gathered from American troops’ social- 
media profiles. The effects could be further 
amplified by impostor social-media accounts 
meant to look like reputable or high-ranking 
MilVets and the organizations that represent 
them — while thousands of bot accounts 
(autonomous programs on the internet 
designed to behave like real individuals) are 
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activated to make it confounding to discern 
fact from fiction. 


In 2018 yet another growing threat related to 
impostor social-media accounts that target 
the intelligence and defense communities 
was brought to light. LinkedIn was singled 
out as a platform exploited by China through 
the use of impostor accounts meant to blend 
in with those of MilVets and intelligence 
professionals.” US officials have said that 
there is some correlation between targets 

of the Chinese LinkedIn campaign and the 
OPM data breach. Recent court documents 
have demonstrated that China uses LinkedIn 
to target Americans for recruitment as spies 
and then pays those spies to hand over the 
information of LinkedIn users they connect 
with. This tactic is as easy as creating a fake 
profile using a picture of a servicemember 
and falsifying a military afhliation in the 
account's work history. 


This report will focus on the recent 
targeting of MilVets by foreign entities 
online — primarily on social-media 
platforms. We document the creation of 
websites meant to mislead as well as mine 
data from and implant malicious software 
into the computer systems of American 
servicemembers and veterans. The tactics, 
techniques, and procedures (TTPs) that 
foreign entities use to build audiences and 
spread disinformation and social discord 
will be displayed visually so that readers can 
see how this problem looks and evolves. We 
also reanalyzed the ads known to have been 
created by the Russian Internet Research 
Agency (IRA) to reveal that the targeting 

of MilVets during the 2016 campaign 

was So specific that the Russians paid to 
explicitly reach followers of the Facebook 
pages of trusted VSOs such as “Vietnam 
Veterans of America, “Disabled American 
Veterans, and “AMVETS,” as well as veterans 
organizations afhliated with far-left and 
far-right politics such as “Vietnam Veterans 
Against the War” and “Concerned Veterans 
for America.’ The report will conclude with 
policy recommendations for coordinating 
the response necessary to protect veterans 
and national security in this world where 
everything is connected through the 
internet — through the Fifth Domain: the 
newest theater of warfare. 


13 


14 


APPROACH 


This report will provide a detailed qualitative 
analysis of the methods foreign adversaries 
use to target servicemembers and veterans 
in cyber-environments, as well as provide 
recommendations for the White House, 
Congress, and the private sector to respond 
effectively. Our analysis will reveal previously 
unpublished findings that include, but are 
not limited to, a massive campaign to trick 
veterans into downloading malware by an as- 
yet-unidentified foreign entity. 


To conduct this study, we analyzed suspicious 
social-media activity in and around the 
tight-knit community of MilVet advocates 
centered in Washington, DC, for two years, 
beginning in August 2017. Suspicious 
social-media accounts and websites were 
documented with screen-captures (a 
screenshot of an image on a computer, 

tablet, or cell phone), then catalogued and 
organized by date of recording. 


“Suspicious activity’ includes: coordinated 
inauthentic behavior;!® spelling and grammar 
mistakes typical of non-native English 
speakers; sharing URLs that are associated 
with malware; masking of links with URL- 
shorteners; soliciting personal information 
from MilVets; the use of ad technology to 
target and retarget MilVets; and the use of 
the same MilVet-related photos, memes (a 
captioned picture or video, often altered 

to be humorous, that is copied and spread 
online), or links across multiple accounts 
and platforms. Suspicious activity also 
includes false representation of MilVet 
status or VSO afhliation and the spreading 
of known foreign-state-sponsored and state- 
controlled propaganda such as TASS,'® RT,?° 
and Sputnik News.?! Other suspicious activity 
includes the changing of the names and 
focuses (ie, topics of discussion, themes) of 
pages and groups related to MilVets. 


Searches were performed via the Internet 
Archive Wayback Machine”? to examine 
now-shuttered websites and the previous 
editions of websites that are still functioning. 
Suspicious websites whose information was 
publicly available were examined via the 
DomainTools WHOIS page” to determine 
country of origin, date of creation, registrar, 
and registrant. Suspicious written content 
was checked for plagiarism/origin via the 


Google search engine and the website 
PapersOwl.com. Reverse-image-search was 
performed with the TinEye Google Chrome 
Plugin, as well as Google’s reverse-image- 
search function. 


Facebook's automated “recommended 
pages’ and “related pages” functions that 
appear on users’ Facebook pages on desktop 
were used to map networks of suspicious 
pages targeting the MilVets community. 
How Facebook's algorithms determine 

what pages are related or recommended is 
unclear, but the tool has been consistently 
useful nonetheless. Beginning in August 
2018, Facebook made available to users 

in the United States a function to reveal 

the countries of origin of admins of pages 
with very large followings and those who 
have purchased ads on politically sensitive 
topics and “issues of national importance, 
which appears to include all MilVet-related 
merchandise. When available, admin profiles 
of the less-followed individual Facebook 
pages, group administrators, and bots 
(autonomous programs on the Internet 
designed to behave like a real individual) 
were examined to determine likely country 
of origin based on geographic “check-ins,” 
likes, and the languages used in public posts. 


All Russian IRA ads released by the 

House Permanent Select Committee on 
Intelligence (HPSCI)*4 were examined, and 
we determined that 113 of them included 
unredacted imagery and/or text content and/ 
or targeting details that were related to the 
MilVet community. Isolating the MilVet- 
focused IRA ads from the rest allowed new 
patterns to emerge. We analyzed the ads by 
separating them into subcategories according 
to the specific affinity groups or divisive 
issues that they targeted, paying special 
attention to the ads with which the Russians 
specifically targeted VVA and other legitimate 
veterans organizations. 


Most suspicious accounts in our investigation 
on Twitter found us — following, retweeting, 
and liking VVA-afhliated Twitter accounts in 
unusual yet predictable patterns. Twitter's 
automated “who to follow” function that 
appears on users browsers and mobile apps 
allowed us to identify networks displaying 
coordinated inauthentic behavior. As is the 


case with the similar Facebook function, 

it is unclear how the algorithm works, but 
Twitter's automated recommendations were 
very helpful for mapping bot networks. 
Other Twitter accounts were brought to our 
attention by MilVets and other VSOs who 
were aware of our investigation and believed 
they had spotted suspicious behavior. 


Facebook’s free Google Chrome extension 
“CrowdTangle’™ was used to determine 
which social-media accounts had shared 
specific links, such as web pages featuring 
falsified news. This helped us to identify 
coordinated inauthentic behavior and related 
accounts that spanned various social-media 
platforms. This tool also lists the number 
of followers of each social-media account 
that shared these links and the number of 
reactions (likes, shares, retweets, etc.) each 
shared link resulted in. This helped us to 
estimate the impact and virality of certain 
content. 


APPROACH 
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ABBREVIATIONS 


AI: Artificial Intelligence 

APT: Advanced Persistent Threat 

C2: Command & Control 

CVA: Concerned Veterans for America 

DoD: Department of Defense 

HPSCI: House Permanent Select Committee on Intelligence 
IAVA: Iraq and Afghanistan Veterans of America 

ICA: Intelligence Community Assessment 

IRA: Russian Internet Research Agency 

MilVets: Military and Veterans 

NSPM: National Security Presidential Memorandum 

OPM: Office of Personnel Management 

PII: Personally Identifiable Information 

TTPs: Tactics, Techniques, and Procedures 

URL: Uniform Resource Locator (also known as a web address) 
VA: Department of Veterans Affairs 

VPN: Virtual Private Network 

VSO: Veterans Service Organization 


VVA: Vietnam Veterans of America 
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GLOSSARY 


This list contains terms narrowly defined within the context of and 1n relation to this investigation. 


Admin/administrator: a Facebook admin/administrator controls and manages settings on pages and 
groups 


Adware: usually refers to unwanted advertisements or malware (malicious software) 

Antifa: stands for the “anti-fascist” movement that had its roots in left-wing protests against right-wing 
conservatism; a loose collection of regional groups and individuals aiming — through peaceful and 
violent measures — to resist and disrupt political actions they consider to be far-right and/or racist 
App: short for “application, a program for personal electronic devices 

Bot: autonomous programs on the internet designed to behave like real individuals; some run 
automatically, while others require specific input to execute commands; bots are often used to 


perform malicious actions 


Command and Control: the exercising of authority by a commander (including planning, 
coordinating, directing, and controlling) to accomplish a mission 


Cyber Caliphate: cyber-hacker group self-identifying as the digital army for ISIS 


Cyber-health/cyber-hygiene: practice of risk mitigation online; includes taking steps such as 
changing passwords frequently and installing antivirus software 


Cyber-kinetic warfare: in which enemy forces can detect or interfere with electronic devices and use 
them to cause physical harm 


Dark web: a collection of websites that use anonymity tools to hide their IP addresses 

Deepfake: Combining/superimposing images or video, often with the nefarious purpose of producing 
video/images of people who may not actually exist or of real people saying/doing things they did not 
actually do 

Deep Panda: a Chinese-government-sponsored threat group 

Dog whistle: a strategy to communicate that sends a subtly coded message 


Evergreen content: content that does not become dated 


Facebook group: joining allows Facebook users who share common interests to be connected and 
communicate in one place 


Facebook page: for business accounts and public figures to create an online presence; offers 
advertising features 


False flag: a covert operation designed to deceive; the deception creates the appearance of a 
particular party, group, or nation being responsible for some activity, disguising the actual source of 
responsibility 


Falsified news: real news stories that are subtly altered in order to provoke outrage, often includes the 
plagiarization of complete articles with only the date of publication changed so that readers are made 
to believe the content is more recent 


Fancy Bear: Russian cyberespionage group, also known as APT 28 


Follows: when a person “likes” a Facebook page or connects with a social-media account, they will 
automatically see updates in their news feed 


Inauthentic behavior: misleading actions to deceive others about who an individual/group is or what 
the individual or group is doing 


GLOSSARY 
IP: Internet Protocol, which is a numerical label that identifies a device and location 


Junk news: misleading or deceptive content, deliberate misinformation purporting to be authentic 
and true 


Like: a social-media feature that allows users to express a positive reaction or support to content 


Link/URL-shortener: a tool to shorten links, which can be used to circumvent bans or disguise 
websites 


Malware: malicious types of software such as adware, spyware, viruses 


m.me URL: a shortened URL that Facebook users can use to enter into a conversation with the 
affliated page admin 


Meme/internet memes: an image, video, or concept, often captioned and altered to be humorous, 
that is copied and spread online 


News feed: a list of updates about friends on a Facebook home page as well as advertisements 
Retweet: reposting content by another user on Twitter, with or without an additional comment 


Screen-captures/screenshots: a copy of the image that appears on a cell-phone, tablet, or computer 
screen 


Social media: websites or apps that allow users to interact and share content 

Sockpuppet: a false online identity meant to deceive 

Spam: unsolicited messages sent to a large number of recipients 

Spear-phishing: sending emails from an ostensibly trusted source to solicit confidential information 
Spoof: creation of an IP with a false address 


Spyware: a kind of malware, which a user unknowingly installs, that can gain access to the computer 
and steal data 


Tab: a feature on Facebook that loads content; examples are “About” tab, “Community, “Info and Ads” 


Troll: a person who seeks to sow discord, disrupt, or influence behavior on the internet by posting 
inflammatory content 


Troll farm: an organization whose members or employees engage in online behavior that is meant to 
disrupt, distract, cause conflict, and influence conversations/behavior for nefarious purposes 


Useful idiot: a naive person who is persuaded by a group (usually through deception) to further its 
political agenda without fully comprehending the goal or its ramifications 


WHOIS: an Internet service used to look up information about a domain name or IP address 


Zero-day vulnerability: a computer-software vulnerability unknown to the manufacturer, typically 
used in targeted attacks 
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CHAPTER 1: The Imitation of Vietnam 
Veterans of America (VVA) 


Similar to widely reported stories of those 
organizations known as troll farms that 
engaged in nefarious online behavior, sowed 
discord during the 2016 election cycle, and 
specifically targeted veterans,” the following 
online entities operate by first appealing 

to patriotic Americans, and once they have 
gained the trust of tens or even hundreds of 
thousands of followers, they begin spreading 
manipulated and divisive news and other 
political content. 


VVA is a congressionally chartered VSO 
whose membership exceeds 86,000 Vietnam 
veterans living around the globe. For many 
of our aging and disabled veterans, their 
most significant connection to VVA and 

the outside world is through the use of 

the internet and social-media platforms 
(Figure 1). According to a recent University 
of Oxford study, veterans are trusted by the 
civilian populace as opinion leaders, which 
makes us an economically efficient target for 
influence from the perspective of America’s 
adversaries.”’ 


The First Bulgarian Entity: 
“Vietnam Vets of America,’ 
“Nam Vets,” and “Vietnam- 
Veterans.org”7® 


On August 21, 2017, we discovered a Facebook 
page titled “Vietnam Vets of America, ?° 
which had at times been using our logo and 
registered trademark to deceive its online 
audience into thinking it was an afhiliate of 
our legitimate VSO (Figure 2).2°?! 


Posts from “Vietnam Vets of America” 
typically linked to vvets.eu, a website 
anonymously registered®? through Netfinity 
JSC** of Bulgaria. After filing complaints for 
copyright infringements via Facebook's help 
tools, we monitored the page for activity and 
reached out directly to report the suspicious 
page to a member of Facebook’s security 
team on August 28, 2017. 


While most of the posts shared on “Vietnam 
Vets of America’ were junk memes of no 


particular significance, the page frequently 
shared deceptive or manipulated news 

and political content that was spread with 
the intent of inciting anger from veterans 
(Figures 3 and 4). On September 26, 2017, 
the page shared a manipulated video using 
“Facebook Live,’ which for approximately 
four hours streamed a looped 58-second- 
long clip about a Vietnam veterans 
monument being defaced.*4 We immediately 
reported this to Facebook’s security 

team and logged a complaint for “spam” 
(unsolicited messages sent to a large number 
of recipients) via Facebook's video-reporting 
function. The original video had been 
produced by News 22 WWLP, a local news 
station from Springfield, Massachusetts; 
however, the “Vietnam Vets of America” 
inserted a caption over the video that read, 
“DO YOU THINK THE CRIMINALS MUST 
SUFFER?” with icons encouraging people 

to respond with the “heart” and “angry- 
face” reactions (Figure 5). These emoticon 
responses are interpreted by Facebook's 
algorithm as indications that the user is 
more invested in the content than a user 
who reacts with the traditional thumbs-up 
“like” response.®* The algorithm then funnels 
the more-invested users additional content 
similar to that which they've engaged with 
using those responses; this includes placing 
the impostor “Vietnam Vets of America” into 
the users’ Facebook feed more often. 


Over the course of the four-hour video, 
thousands of shares, comments, and 
reactions were produced — taking 
advantage of Facebook’s algorithms that 
promote popular “live” videos, increasing 
the likelihood that people who hadn't yet 
clicked “like” or followed the page would 
be exposed to it. This video contained a 
link to the vvets.eu website, which copied 
verbatim the written content of News 22 
WWLP’s reporting.®” By October 8, 2017, the 
manipulated video had been viewed over 
37,000 times. 


(text continued on page 25) 
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Figure 1: VVA’s real Facebook page features a grey checkmark, showing that Facebook has confirmed this as an 
authentic page for this organization. 
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Figure 2: lmpostor Facebook page: “Vietnam Vets of America.” 
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Figure 3: “Vietnam Vets of America” frequently and repeatedly reposted the same inflammatory news. Language errors 


raise red flags. 
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Figure 4: VVets.eu-connected Facebook pages linked many of their posts to the same inflammatory news articles over 
and over again. [he screen-capture above shows an article originally posted on August 26, 2016, which had amassed 
at least 8,200 shares on Facebook by October 10, 2017 Note that the date at the top-left directly above the photo is 
26.08.2016, using the format “day.month.year” which is uncommon among Americans. 
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Figure 5: Impostor VVA Facebook page shares manipulated video of divisive news event. Between the September 26, 
2017 broadcasting and October 6, 2017 when this screen-capture was made, the video had been viewed at least 3Z000 


times and shared 1,290 times. 
(text continued from page 22) 


News 22 WWLP broadcast the original video 
on September 25, 2017. The Bulgarian entity 
quickly identified this news event and within 
24 hours had produced its own four-hour- 
long looped version. The fact that the foreign 
entity recognized a divisive news story and 
was able to so expeditiously manipulate it 
and spread it as propaganda suggests that 
they are closely watching even the local 
American media. 


Other divisive, political content shared 

by “Vietnam Vets of America” included 

the NFL's “Take a Knee” and boycott 
controversies,*® as well as commentary on 
“Blue Lives Matter.’®? While these types 

of posts were popular among Americans 
and were also generated organically and 
domestically on social media, their creation 
and use by a foreign entity is consistent with 
information-warfare tactics described in the 
Russian book Information-Psychological War 
Operations: A Short Encyclopedia and Reference 
Guide. 


The Guardian reports: 
The book is designed for “students, political 
technologists, state security services and civil 


servants’ — a kind of user’s manual for junior 
information warriors. The deployment of 
information weapons, it suggests, “acts like 
an invisible radiation” upon its targets: “The 
population doesn't even feel it is being acted 
upon. So the state doesn’t switch on its self- 
defence mechanisms.’ If regular war is about 
actual guns and missiles, the encyclopedia 
continues, “information war is supple, you can 
never predict the angle or instruments of an 
attack.”4° 


The rate at which the “Vietnam Vets 

of America” page grew in followers is 
staggering. According to their “About” 

tab, they went from 30,000 followers on 
November 1, 2016, to 196,567 as of October 
2017.1 For comparison, the real VVA page has 
garnered 188,755 likes since it was created in 
June 2010. 


On October 9, 2017, after having not found 
a solution through talks with Facebook’s 
security team,‘? VVA began to go public via 
the press with appeals to the Department 
of Defense (DoD) and the Department 
of Veterans Affairs (VA) to take proactive 
measures to protect servicemembers and 
veterans online from foreign political 
influence.*? 

(text continued on page 381) 
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Figure 6; “Vietnam-Veterans.org” Facebook page created in December 2017 using a new, original logo. 
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Figure 7: The Crowd Tangle report on social-media shares of the impostor “Vietnam-Veterans.org’ website shows that 
the admins of the official United States Army Field Band's page shared it, then received 19 interactions in the form of 
comments, likes, and shares from their followers. 
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Figure 8: The Facebook page “Nam Vets” started by using the trademarked name and logo of VVA, a congressionally 
chartered veterans service organization. The profile photo for this page was later changed, possibly as a reaction to 
trademark-infringement complaints by VVA against the admins’ other pages. 


27 


Milita ry.com BENEFITS NEWS VETERAN JOBS MILITARY LIFE VIDEOS DISCOUNTS 


"Veterans access to timely, high-quality health care is one of this 
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The change, which the budget describes as a ‘modernization, would stop 
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payments reaches the minimum age to receive them. Veterans who have 
already reached the age to receive Social Security would be removed from 
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Figure 9: The original Stars and Stripes article by Nikki Wentling was posted on May 23, 2017 
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to seek health care in the private sector at the VA's expense. Trump's budget also asks for $3.5 billion more for 
the program in 2019 and every subsequent year. 


The increase would bring the total amount that the VA spends through its various community care programs to 
$13.2 billion in fiscal 2018. 


The Choice program — created in response to the system-wide scandal of veterans suffering long waits for 
health care — was Set to end Aug. 7, 2017. Congress passed legislation in April allowing it to continue beyond 
the expiration date with the approximately $1 billion remaining of $10 billion appropriated for the program in 
2014. 


It's now authorized to continue until it runs out of money. VA Secretary David Shulkin is working on 
improvements to the program, which has been criticized by veterans and lawmakers as confusing and complex. 


“Veterans’ access to timely, high-quality health care is one of this administration's highest priorities,” the budget 
states. “The budget provides mandatory funding to extend the Veterans Choice Program, enabling eligible 
veterans to receive timely care, close to home.” 


Listed as one of the offsets for the extra cost is a new restriction on compensation for veterans through the 
VA's “individual unemployability” program. 


The change, which the budget describes as a “modernization,” would stop the higher payments once a veteran 
who is eligible for Social Security payments reaches the minimum age to receive them. Veterans who have 
already reached the age to receive Social Security would be removed from the VA benefit program if Congress 
approves the proposal. 





Figure 10; Text of original Stars and Stripes article (Figure 9) matches text on wets.eu website, where it was posted as 
falsified news with the date changed. 
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Figure 11: “The “Nickmitov’ Reddit account was active until approximately October 2018. 
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Figure 13: The “Nickmitov” account shared veteran-targeted posts including links to the website “ptsd-symptoms.info” as 
early as April 2015. Ptsd-symptoms.info was also registered by Nick Mitov. 
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(text continued from page 25) 


On October 18, 2017, Facebook responded 

to questioning by Stars and Stripes regarding 
VVA’s specific complaints by saying that the 
impostor “Vietnam Vets of America” page 
had not violated Facebook terms of use“ and 
placed the burden on VVA to speak out and 
educate Facebook users about the impostor 


page. 


On October 24, 2017, Facebook removed the 
suspect page for violation of VVA's copyright, 
though no information was publicly shared 
regarding who had been operating the page.” 
At a November 1, 2017, hearing before the 
Senate Intelligence Committee on Russian 
interference in America’s election using 
social media, Facebook’s lawyer, Colin 
Stretch, was questioned directly on the 
matter by Senator Joe Manchin of West 
Virginia.*° Mr. Stretch denied knowledge of 
the impostor VVA page and the efforts to 
target veterans.” Nor did Mr. Stretch promise 
specific efforts by Facebook to counteract 
such deception aimed at veterans. 


To date, DoD and VA have yet to respond to 
VVA’s request* that they coordinate federal 
efforts to protect servicemembers and 
veterans from deceptive, foreign-generated 
online content. 


On February 21, 2018, we became aware of 
two new Facebook pages, “Nam Vets” and 
“Vietnam-Veterans.org, which linked to 
vvets.eu as well as a sister website, Vietnam- 
Veterans.org, which uses a similar logo 

and posts identical content (Figure 6).‘ 
According to the “About” tab of the “Nam 
Vets” Facebook page, it reached 500 followers 
on November 24, 2017, and before it was shut 
down in March 2018, it had reached 3,044 
followers.°® The Facebook page “Vietnam- 
Veterans.org” first posted on December 10, 
2017,°' and it had approximately 155 followers 
upon being closed in March 2018.” Although 
these pages had relatively few followers, 

they had an engaged audience who often 
responded to posts asking them to divulge 
information such as what unit they served 
with and when they were deployed. 


The “Vietnam-Veterans.org” page was 
authentic-looking enough that the United 
States Army Field Band’s blue-check-verified 
Facebook page*® shared the website with 

its 89,000 followers to celebrate Vietnam 
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Veterans Day 2018 (Figure 7). The US Army 
Field Band’s original post read: 


We set aside time to honor our nation’s heroes 
at every concert. If you know a Vietnam 

War Veteran, thank them for their service 
today by tagging them in the comments 
below. #VietnamVeteransDay #heroes U.S. 
Department of Veterans Affairs Vietnam 
Veterans of America 


This post by an official DoD-afhliated 
account tagged the blue-check-verified "U.S. 
Department of Veterans Affairs” Facebook 
page, as well as VVA’s authentic Facebook 
page. Recognizing that reporting these pages 
to Facebook results in only temporary relief, 
we have ceased filing reports for abuse or 
illegal trademark use. We learned from the 
incident with the original impostor VVA page 
that Facebook’s policy of simply shutting 
down pages does not prevent others from 
rising in their place — nor does it bring us 
closer to finding out who is behind these 
pages or what their motivations are. As soon 
as our first report went public, however, the 
inauthentic pages listed in that report (which 
was Shared with various federal agencies and 
congressional committees in March 2018) 
were closed. 


Like the now defunct “Vietnam Vets of 
America’ page, the “Nam Vets” Facebook 
page began by using VVA’s logo to gain 

trust from American veterans. According to 
the timestamp on the post with our stolen 
logo, the “Nam Vets” Facebook page was in 
existence as early as April 17, 2015 (Figure 8). 


The first “Nam Vets” posts linked to a now- 
archived Europe-based website containing 
inflammatory political content such as 
videos of protesters stomping on American 
flags.** Content more recently posted on 

the Facebook pages and affiliated websites 
included pictures and videos of veterans’ 
memorials being defaced (with deceptive 
dating to make these events appear 

more recent), a video produced by the 
Department of Veterans Affairs,°® and the 
illegally copied text*’ of an article written by 
Nikki Wentling of Stars and Stripes®® (Figure 9) 
regarding cuts to veterans’ benefits — which 
was posted well after it was current news*® 
(Figure 10). The new site Vietnam-Veterans. 
org was registered to one “Nikola Mitov,’ also 
through Netfinity JSC of Bulgaria. 


(text continued on page 83) 
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Figure 15: Vietnam-Veterans.org’s Instagram account posted the same content as the Twitter account. 
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(text continued from page 81) 


It is unclear if Nikola Mitov is a real person or 
a pseudonym, or if multiple people operate 
accounts that are registered to that name. 
When searching the street address (“210 

6-th september BLVD”) for the registrant 
provided on the Internet Corporation for 
Assigned Names and Numbers (ICANN) 
website, it shows up in Ukraine,®! rather than 
Bulgaria as listed — although this may be due 
to translation errors or limitations of Google 
Maps. 


Both Bulgaria® and Ukraine® have struggled 
to control online trolls®** who work to 
promote pro-Russian disinformation. 


Using CrowdTangle to determine who had 
shared the vvets.eu website, we were able to 
find a Reddit account using a variation of the 
name that had registered the website, “Nick 
Mitov’ (Figures 11-18). In addition to sharing 
vvets.eu, this Reddit account also promoted 
the now-defunct website ptsd-symptoms.info 
since at least April 2015. 


The Bulgarian Vietnam-Veterans.org entity 
also created accounts across at least two new 
social-media platforms, including Twitter® 
and Instagram. These Twitter, Instagram, 
and Facebook accounts posted identical 
content (Figures 14-16) until Facebook took 
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Figure 16: “Vietnam-Veterans.org’ Facebook 
page acting in tandem with Twitter and Instagram 
accounts. 


down the “Vietnam-Veterans.org” page after 
our earlier report went public. 


The Vietnam-Veterans.org Twitter and 
Instagram accounts are still operational, 
which may mean that the foreign entity 
behind them can still be traced by law 
enforcement. 


The Broader Investigation 
Begins 


This imitation episode led us to expand 

our search for other foreign entities 
impersonating MilVets organizations. Since 
March 2018, we have manually inspected and 
cataloged over 150 Facebook pages, most of 
which are either directly targeting MilVets or 
are tangentially connected to other pages® 
that are directly targeting MilVets. Admins 

of the pages that we have analyzed are 
operating from at least 32 countries outside 
the United States.®* Because Facebook reveals 
the countries of origin only for admins of 
pages who either have well over 100,000 
likes or followers, and of pages that have 
purchased political ads, many of the pages 
we tracked have not had admin locations 
revealed. 


(text continued on page 85) 


Em Pas f i ke ot ie Tal aT ice | boa Wetee re : 
3. Sree i Like 3 Follow > Share 


‘arg tah hed eo oe 
et pe tte a 


View 6 more comments 


r Vietnam Veterans Advocacy Group shared a link. 
eto May 1/7 at 4:00pm: % 


Vietnam Veterans 
Advocacy Group 


@VietnamVeteransAdvoc 
acy 
Home * 
About _ “ 
| ie Michael Avenatti @ 
Videos ee OMichaelAvenat 
a TRUTHJUST.COM 
Posts Trump just admitted he paid off Stormy Daniels. Michael 
Avenatti's response is perfect - JustTheTruth 





Communit 


Figure 17: The “Vietnam Veterans Advocacy Group” shared only pro-Obama and anti-Trump articles from j/unk-news 
websites. 
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Figure 18: “Vietnam Veterans Advocacy Group’ sharing anti-Trump junk news from websites truthjust.com and 
flashviralnews.com. 


(text continued from page 33) 


At least one-third of the pages that we 
evaluated since we began our investigation 
have since been shut down by Facebook 
during various purges for “inauthentic 
behavior.’°? The now-shuttered Facebook 
pages that we had been monitoring had 

a combined following of over 32 million 
Facebook users.” Nearly 10 percent of the 
total pages evaluated specifically targeted 
Vietnam veterans, while other pages targeted 
veterans of other generations, veterans of 
specific military branches, or veterans more 
generally. These veteran-focused Facebook 
pages are often related to others that target 
specific demographics and ideological groups 
of Americans. Foreign admins use these 
pages to try to drive wedges between groups 
along varying racial or ethnic identities or 
prejudices, often pitting law enforcement 
against minorities. 


Unknown Origins: The 
Anti-Trump “Vietnam 
Veterans Advocacy Group” 


A Facebook page named “Vietnam Veterans 
Advocacy Group’ was created on December 
380, 2017, and by the time we discovered it on 
July 10, 2018, it had amassed 142,835 likes. 
Unfortunately, at this time Facebook had 
not yet implemented the feature that reveals 
admin country locations for pages with very 
large followings. 


“Vietnam Veterans Advocacy Group’ at 

first had been posting only politically 
inflammatory, anti-Trump stories from 

the junk-news websites www.truthjust. 

com” and flashviralnews.com” (Figures 

17 and 18), which were co-hosted with 

the website ExposingGovernment.com. 
ExposingGovernment.com was once a 
similar junk news site,”® but today contains 
only a link to trick visitors into downloading 
the malware SecuryBrowse. SecuryBrowse is 
a Google Chrome extension that brands itself 
as an antivirus tool, but its primary function 
is to direct users to afhliated websites that 
expose them to additional security threats.” 
These three websites were registered 
anonymously through third-party privacy- 
protection groups. According to the WHOIS 
Internet Corporation for Assigned Names 
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and Numbers (WHOIS ICANN) service, 
truthjust.com and flashviralnews.com were 
registered via Proxy Protection, LLC, out of 
California, while ExposingGovernment.com 
was registered via Perfect Privacy, LLC, from 
Florida. 


The “Vietnam Veterans Advocacy Group” 
Facebook page was taken down by Facebook 
on or before August 2, 2018. Prior to being 
taken down, as of July 20, 2018, it appeared 
that either Facebook or the page admins 
had purged hundreds of posts related to 

the junk-news websites listed above. The 
“Vietnam Veterans Advocacy Group’ page 
was then filled by its admins with scores of 
pro-Barack-Obama memes. It is unclear if 
Facebook had purged specific links and posts 
in this way or if this action was done by the 
page admins. 


Unknown Origins: “Vietnam 
Vets Unite” 


Some Facebook pages have a “Community” 
tab for users to publicly post and interact 
with varying levels of moderation by the 
page admins. “Vietnam Veterans Advocacy 
Group’ had one such Community tab, where 
a user promoted another page, “Vietnam 
Vets Unite.” This page, which was created on 
November 26, 2016, frequently posts photos 
from the Vietnam War in an attempt to 
build its audience — cycling through a single 
batch of photos and reposting them over 
and over, with as many as 15 posts per day. In 
between these photos are advertisements for 
veteran-themed memorabilia from Amazon. 
This Facebook page has been advertising 
counterfeit VVA-branded merchandise since 
December 4, 2016.” 


“Vietnam Vets Unite” has advertised at least 
two different VVA-branded items. The first is 
a challenge coin, a commemorative trinket 
featuring VVA's trademarked name and 
logo, sold by by Coins and Coins (Figures 19 
and 20), which sells merchandise through 
Amazon.” 


The second VVA-branded item is a flag 
sold by Breeze Decor (Figures 21 and 22) 
through Amazon, which according to the 
Amazon” site sells products “proudly made 
in the USA.”"” The afhliated Breeze Decor 
website, however, says that it is owned by 
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the Germany-based company TWO Group. 
The LinkedIn page for “T'WO Group” says 
that it “is aGerman-owned company with 
its headquarters in Stuttgart German and 
Guangzhou China, and offices in UK, USA, 
Czech and Hong Kong /sic/” (Figure 28).” 
The TWO Group website, however, is a 
China-based site that appears to have been 
shut down by the Chinese government for a 
licensure discrepancy (Figures 24 and 25). 


Because of this complicated web of 

stores that sell on Amazon, international 
companies, and foreign-based websites, it 

is difficult to tell who it is that benefits from 
selling counterfeit VVA-branded products or 
what their motivations for doing so may be. 
Is the primary purpose of the “Vietnam Vets 
Unite” Facebook page to earn money selling 
merchandise? Or is the posting of MilVet 
trinkets simply meant to add credibility to 

a page designed to spread divisive political 
propaganda? Because this Facebook page 
has a small following and has not purchased 
political ads, the admin locations are not 
revealed. 


With complete anonymity, the admins 
behind these social-media accounts are able 
to confuse the non-political message of VVA 
and other VSOs while profiting financially by 
defrauding veterans and supporters. 


International Effort to Sell 
Counterfeit VVA-Branded 
Products, Alongside 
Racist Messaging, Russian 
Propaganda, and Sales of 
Pro- Trump Merchandise: 
“Vietnam Veterans” 


There are countless impostor pages similar 
to those above that falsely present themselves 
as representing American veterans and 
afhliated patriotic organizations: They build 
an audience and obtain their trust using 
sophisticated and deceptive tactics and then 
prey on them for financial gain and to exploit 
divisions and spread hateful, anti-American 
messages. 


The Facebook page “Vietnam Veterans, ®° 
according to its Info and Ads tab at the time 
this report was being prepared, had two 


admins in Vietnam and one in the US,®! 

as well as 185,128 followers. It is unclear if 

a virtual private network (VPN) or other 
technology can be used to spoof admin 
locations to make it appear as if admins are 
operating in different countries from their 
actual physical location — though Facebook's 
Threat Intelligence Team assured us during a 
meeting that this is not possible. 


This page posts multiple times per day with 
messages like “Support our Vietnam Veteran” 
and “Only for Vietnam Veteran” (next to a 
picture of a post-9/11 Marine in Afghanistan) 
with links to merchandise on third-party 
websites such as GearBubble. The thousands 
of people who see these posts on social 
media each day in isolation might reasonably 
believe that a portion of the proceeds goes 
toward supporting Vietnam veterans or 
legitimate Vietnam veterans organizations 
like VVA — though there is no evidence that 
this is the case. 


The Facebook page “Vietnam Veterans” 

has also been engaged in advertising 
counterfeit VVA-branded products since at 
least November 24, 2016* (Figure 26). The 
page has also used VVA’s logo to promote 
politically divisive memes and content 
(Figure 27). In order to make this impostor 
page more closely resemble a VVA-afhliated 
page, the admins have stolen pictures and 
content from the official VVA Facebook page. 
These stolen graphics feature our name and 
logo, and photographs include VVA’s CEO 
John Rowan visiting a war memorial (Figures 
28 and 29). 


The “Vietnam Veterans” page's co-opting of 
the photos featuring VVA’s leadership and 
VVA’s branded content is done to make the 
impostor page appear authentic and to build 
viewership. This page also features memes 
known to have been developed and used 

by the Russian-based IRA’s social-media 
accounts and content created specifically 
for the Bulgarian entity, “Vietnam Vets of 
America’ (Figure 80). As confirmed in the 
Mueller report, “Being Patriotic” (Figure 31) 
is one of the Russian IRA’s unique brands.** 
“Being Patriotic” memes were frequently 
used by this entity well after the original 
page was taken down; it’s important to note 
that these divisive memes were recycled 
and reposted by “Vietnam Veterans” on 
November 2, 2017, long after the elections. 
This page edited out the “Being Patriotic’* 
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Vietnam Vets Unite 
Like This Page - December 4, 2076 -@ 


Vietnam Veterans Challenge Collectible Coin Logo 
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http://order.sale/DHYqg (via Amazon} 
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Figure 19: “Vietnam Vets Unite” Facebook page linking to an Amazon store offering counterfeit VVA-branded 


merchandise from the seller Coins and Coins. 
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C) Report incorrect product information. 
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Figure 20: The Amazon store Coins and Coins selling VVA-branded merchandise, which is linked to from the “Vietnam 


Vets Unite” Facebook page. 


scroll from the bottom of the original 
graphic but otherwise left the meme in its 
original form (Figure 32). 


Just days after the 2016 election, “Vietnam 
Veterans’ advertised political Trump- 
branded merchandise with the slogan “Hey 
TRUMP Let’s MAKE NAM VETS GREAT 
AGAIN” (Figure 383). As a matter of VVA’s 
nonpartisan charter and status as a VSO, VVA 
has not and will never endorse a political 
candidate; similarly, VVA would never 
adopt a version of a political campaign 
slogan for our merchandise — but the 
activity of “Vietnam Veterans” may confuse 
social-media users who see this political 
merchandise being sold by an entity using 
VVA’s branding. 


According to the text of the post, this item, 
a t-shirt, was listed as part of a three-day 
sale, from November 9, 2016, to November 
11, 2016. However, the date was formatted 
in a way that is unfamiliar to Americans: 
“(9-11/11).” The way the date is written, with 
the awkward capitalization and grammar 
of the post “Comment Yes If you support 
D.TRUMP and proud to wear this t-shirt” 

is a likely indication that this is being 
posted by a non-native English speaker and 
presumably someone outside of the United 
States. Furthermore, the third-party website 
teechip.com, where the t-shirt was sold, 

has no American admins, similar to other 
fraudulent veteran-targeted pages. 
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This entity further obscures VVA's message 
by posting memes that use racist and 
xenophobic rhetoric. VVA condemns the 
slogan “VETS BEFORE ILLEGALS,” a phrase 
commonly posted by this entity on Facebook 
in the same way that counterfeit VVA 
merchandise is sold (Figure 34). There are 
countless undocumented immigrants who 
have served honorably among veterans of the 
United States Armed Forces. VVA has proudly 
worked toward ending the practice of the 
deportation of undocumented immigrants 
who have served in the American military. 


VVA has since its inception supported 
keeping our promise to the brave allies 

who work alongside us in combat as 
interpreters; these allies deserve to settle in 
the United States as refugees and avoid acts 
of revenge perpetrated on them and their 
families. VVA therefore also condemns the 
phrase “VETERANS BEFORE REFUGEES,’ 
another slogan that is used alongside our 
trademarked name and logo by this entity 
(Figure 35). Furthermore, VVA, along with 
other VSOs in an effort led by the nonprofit 
No One Left Behind, has called upon 
Congress to recognize foreign nationals who 
served as interpreters alongside our military 
as “honorary veterans’ of the United States, 
so that VSOs and other American nonprofit 
organizations can legally provide more 
support to these honorable women and men 
and their families.*° 


(text continued on page 46) 
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Vietnam Vets Unite 
Like This Page Ss 


Vietnam Veteran Garden Flag 13" X 18.5" 
http://order.sale/nGWk (via Amazon) 
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Figure 21; The “Vietnam Vets Unite” page uses the link-shortener “ordersale” in posts advertising counterfeit VVA 
merchandise. 
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Figure 22: “Vietnam Vets Unite” Facebook page selling VVA-branded flag via Breeze Decor, which sells products 
through Amazon. 
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Figure 23: The WHOIS records for the Two-Group.com website reveals that it is Chinese in origin. 
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Figure 24: Two-Group.com is the owner of Breeze Decor, which sells products via Amazon and links to a China-based 
website that appears to have been disabled by the Chinese government due to licensure issues. See Figure 25 for 
translation. 
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A Kindly Reminder 


The website is unable to access for the moment 


Sorry, the website is unable to access for the moment. According to the fling requirements of China’s Ministry 
of Industry and Information Technology (MIIT), the website is accessible only if the ICP information is accurate 


and the ICP license is fled.Please contact the person in charge of the website for assisstance. 


Click here to get more details about ICP Filing. 





Figure 25: An English translation of the error message displayed in Figure 24. 
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Figure 26: VVA's trademarked name and logo used to advertise counterfeit merchandise on the Facebook page 
“Vietnam Veterans.” 
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Figure 27: VVA's trademarked name and logo being used to promote politically divisive memes. This graphic features a 
photoshopped image of Jane Fonda’s face in a urinal. Ms. Fonda was widely criticized for a trip to North Vietnam during 
the war and to this day provokes anger in many veterans. 
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Figure 28: “Vietnam Veterans’ is falsely representing itself to gain credibility by posting photos of VVA’s CEO and 
national president John Rowan on its Facebook page. Rowan is the man in this photo and the following one with white 
hair and a hat. In the context of a social-media page that is designed to appear as if it is by and for Vietnam veterans, 
Rowan is widely recognized by the 86,000-p/lus members of VVA. 
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Figure 29: Foreign admins exploit VVA’s participation in a solemn memorial. 
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Figure 30: The Facebook page “Vietnam Veterans” has posted content that was developed for and branded by the 
Bulgarian-based “Vietnam Vets of America” impostor page, which was affiliated with the Europe-based wets.eu website 


that featured falsified and inflammatory news. 
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Figure 31: The “Being Patriotic” online entity is confirmed in the Mueller report to have been operated by the Russian IRA. 
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Figure 32: In the “Vietnam Veterans” posts, the easily identifiable characteristics of all-capital-letter gold-chromatic font 
remains, while the “Being Patriotic” scroll is cut from the bottom of the graphic. 
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Figure 33: “Vietnam Veterans” sells political merchandise in a post that uses non-native English and non-native date 
formatting of “9-11/11,” which translates to “9-11/November” or as Americans would write it, “11/9-117/11° or “November 9-11.” 
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Figure 34: “Vietnam Veterans” posted a “VETS BEFORE ILLEGALS” meme on August 4, 2016. This individual post has 


been shared 342 times on Facebook. 


45 


46 


(text continued from page 38) 


Fundraising Scams 


VVA’s logo has been used by foreign 
nationals to trick unsuspecting Americans 
into financial scams, displaying what is made 
to look like an opportunity to both help 

the organization and make money while 
supporting veterans. VVA has received many 
reports from potential victims who reach 
out to us to verify if these “opportunities” 
are in fact being posted by VVA employees. 
Unfortunately, because these scams often 
occur on Instagram and Snapchat, there is 
no way for VVA to proactively search for 

and report these scams. There is no reverse- 
image-search function for either of these 
social-media platforms, and individual 
scammer accounts can simply restrict who 
can see their posts. 


As aresult, we cannot estimate the number 
of individual Americans who are ripped 
off by scammers using our logo — nor can 
we calculate the damage that causes to our 
trusted brand. 


How the fundraising scams work: 
Scammers use Snapchat and Instagram 
“stories” (pictures and video that display in 
sequence over a defined period 

of time — usually a few seconds each) 

to claim to have access to get-rich- 

quick schemes. They display VVA’s logo, 
information about the organization, offers 
to make several thousands of dollars each 
week for little-to-no work, piles of cash, and 
instructions to “DM” (direct message) the 
user to learn more. 


Victims are then asked to provide their 
personal information as they would for a 
legitimate job. Personal information includes 
name, address, banking information (for 
purported direct deposits), photos, and 
copies of government-issued identification. 
In some cases, victims are asked to hand 
over their username and passwords for 
their banking apps so that the scammer can 
“verify” that the victim “is can handle large 
deposits. /szc/” 


Once the scammers have this information, 
they can quickly empty the victim’s bank 
accounts, open credit-card accounts in 

the victim’s name, and sell the victim’s 
information and identity to other scammers. 


While it may seem unlikely that people 
would fall for a scam like this — the fact is 
that cybercrimes like this happen every day 
to Americans from a variety of backgrounds. 
And these scammers are earning the trust of 
their victims by exploiting VVA’s reputation. 


(text continued on page 49) 
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Figure 35: T-shirts with divisive messages such as “VETERANS BEFORE REFUGEES” are meant to create false 
dichotomies, causing a sense of cultural conflict between veterans and other subgroups of American society. 
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Figure 36: Note: “riahhbby” changed Figure 37 
Snapchat username to “mariahj” during the 
scam. 
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(text continued from page 46) 


Snapchat 


Figures 86-39 show images that appear in 
sequence on as a story on Snapchat bya 
scammer using the account names “riahhbby” 
and “MariahJ” (“riahhbby” was renamed to 
“MariahJ” while VVA was documenting this 
incident). Figure 40 shows a conversation 
where VVA’s communications staff was asking 
the scammer about the “opportunity.” The 
text with the blue line to the left of it is the 
scammer, pretending to be a representative 
of VVA, and the text with the red line to the 
left of it is VVA's staff. 


(text continued on page 51) 
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Figure 40: This private message is sent to victims 
of the fake VVA Snapchat scam. 
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Figure 51 
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Figure 50 


( text continued from page 49) 
nstagram - 
The Instagram account “roxiilucy, which 


has over 28,300 followers and is currently 
still active, has been used to engage in a scam 
very similar to the one described above that 
occurred on Snapchat. However, instead 

of simply posting a still image within its 
story that features VVA’'s logo, it uses a high- 
production-quality video that describes the 
organization in detail (Figures 41-51). The 
video was lifted from YouTube and originally 
produced by one of VVA’s legitimate 
fundraising partners (Figure 52).°’ This 
account's large follower count (and favorable 
follower-to-following ratio*®*), combined 
with the video’s impressive quality, greatly 
increases the perceived legitimacy of the 
scammer in the eyes of potential victims. 
Like the Snapchat scam, the Instagram 
scammer uses screenshots showing large 
bank-account balances as a way of trying to 
fool potential victims into believing they can 
make money by acting as an intermediary for 
payroll and/or donation deposits for VVA. 
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Figure 52: “Pickup Please’ as an official affiliate of VVA. The video depicted in Figures 41-49 was illegally scraped from 
their approved YouTube channel. 
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CHAPTER 2: The Bulgarian and Russian 
Entity: “Veterans of Vietnam” and Their 
Facebook Group, “American Veterans of 


Vietnam” 


On April 1, 2019, we discovered another 
foreign entity that is specifically targeting 
Vietnam veterans. A Facebook page called 
“Veterans of Vietnam,’®? which was created 
on August 20, 2014, and remains operational 
at the time of the preparation of this report, 
had three admins revealed on their Info and 
Ads tab: two admins in Bulgaria and one in 
Russia® (Figure 538). 


“Veterans of Vietnam” appears to have 
remained quite active for nearly four 

years, judging by a current view of its 

page, and features frequent posts from its 
creation through February 18, 2018. Most 

of the posting includes photos from the 
Vietnam war, which is interspersed with 
advertisements for Vietnam -veteran- 
themed t-shirts and memorabilia. These 
characteristics appear to have been consistent 
since the page was launched in August 2014. 
As of July 10, 2019, there’s one Bulgarian and 
one Italian admin. This change coincided 
with a report about Russians working with 
Italy’s nationalist party to interfere in Italy’s 
elections, though this may be an unrelated 
coincidence.°! 


There are no visible posts on the page that 
are dated between February 19, 2018, and 
September 29, 2018; on September 80, 

2018, two posts were added. Since then, the 
page appears to have been inactive, at least 
openly. However, gaps between post dates or 
perceived inactivity may also be in part due 
to posts being removed by admins. 


Why there are periods of inactivity is 
unknown, although the page created the 
closed Facebook group American Veterans 
of Vietnam, so it is possible that the admins 
of the original page remain active. A “closed 
Facebook group’ is a group that reveals 
posts only to Facebook users whom the 
admins allow to enter into the group. Unlike 
with Facebook pages, where admins tightly 
control what appears, Facebook groups are 
designed around the idea of community-led 
discussion, which allows any member to post 


publicly. Admins and moderators, though, 
can delete posts and comments within the 
group, shaping discussions as they see fit. 


Non-members of the American Veterans 

of Vietnam Facebook group can see only a 
summary of the group’s private activity — 
for example: “6 new posts today, 245 posts 
in the last 80 days, 2,480 members, 40 new 
members in the last 30 days” (Figure 54).°? 
The group was created by the “Veterans of 
Vietnam” Facebook page on July 11, 2017. 
While the “Veterans of Vietnam” Facebook 
page is an admin for the American Veterans 
of Vietnam Facebook group, the group 

also has three moderators who are using 
personal accounts.*? The moderators of this 
sroup Sself-identify as being from: Newark, 
Delaware; Perth, United Kingdom; and Deer 
Park, Texas. 


Twenty days after the group was created, the 
admins posted the following message on the 
group page: “We need moderators to help us 
keep this group clean of spammers. If you 
want to be one, comment below’ (Figure 
55). Itis unclear if the Bulgarian and Russian 
admins were already in control of the 
“Veterans of Vietnam” Facebook page at the 
time this request was made. One possibility 
is that this post may have been made by an 
American administrator, who through this 
offer inadvertently opened up the group 
and page to a takeover by the Bulgarian 

and Russian entities, making the Facebook 
page a “sockpuppet.’ Another possibility 

is that this solicitation for moderators 

was a way for the Bulgarian and Russian 
admins to build credibility for their targeted 
American audience and to reduce their own 
workload. The Mueller report says that the 
IRA “recruited moderators of ... social media 
groups to promote IRA-generated content, 
so this request for moderators may be 
consistent with that, finding 

“useful idiots” — as they are known in 
political jargon — to do Russia's bidding.”® 


(text continued on page 58) 
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Page Transparency Summary 


Facebook is showing information to help you better understand the purpose of a Page. 
See actions taken by the people who manage and post content. Learn More 


Page History 


o Page created August 20, 2014 - Veterans of 
Vietnam 


(4 Page name has not changed 
S>° Merged with 0 other Pages. 


See More 


Ads From This Page 


This Page is not currently running ads. 


Give feedback or report this Page 


People Who Manage This Page 

© Primary country location of people who 
manage this Page includes: 
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Figure 53: Screenshot April 28, 2019. The “Page Transparency’ tab for the Facebook page “Veterans of Vietnam” 
reveals that it was created on August 20, 2014, and had two admins in Bulgaria and one in Russia. On June 6, 2019, the 


Russian admin was no longer listed on the page. 
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Figure 54: Moderators for the ‘American Veterans of Vietnam” group includes the “Veterans of Vietnam” page and 
three personal accounts that appear to be well-meaning individuals who do not realize they're working for Russian and 
Bulgarian admins. 
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Figure 55: An admin of the “Veterans of Vietnam” Facebook page posted in the American Veterans of Vietnam group 
Soliciting for volunteers to serve as moderators for the group. Moderators are subordinate to admins but are able to add/ 
remove Facebook users from the group, as well as delete posts and comments within the group. 
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Figure 56: When requesting membership in the closed Facebook group American Veterans of Vietnam, veterans must 
first share the location where they were stationed with the group administrator and moderators. 
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until the 29th of April, 1975 when over Protest of the War? 
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by families in the United States and by Its allies. However, due to the fact that not all 
of the kids were orphans the operation was a little controversial and many people 


argued whether or not it was actually necessary to evacuate so many and if it was in Recent Comments 
the children’s best interests. 


One of the planes that took part in the evacuation was A C-5A Galaxy, serial number 

68-0218 which flew the initial mission of Operation Babylitt departing from Tan Son ; 

Nhut Airport shortly after 4 p.m. on April 4, 1975. Twelve minutes after takeoff, there Archives 

was an explosion as the lower rear fuselage was torn apart. According to DIA ; 

figures, 138 people were killed in the crash, including 78 children and 35 Defense April 2017 

Attaché Office Saigon personnel. February 2017 
October 2016 

There is one fact, however, that can warm our hearts — when American businessman February 2016 

Robert Macauley learned that it would take more than a week to evacuate the 





Figure 57: “What Was Operation Babylift?” is an article that was largely plagiarized from Wikipedia by VeteranLegacy. 
com. 
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(text continued from page 54) 


This option seems more likely, as the 
veteran-focused merchandise advertised 

on the page is similar to that of other pages 
with foreign admins, and the behavior of 
the page and group appears to be consistent 
before and after the date of the post. This 
request for moderators is also consistent 
with behavior that we've monitored from 
similar veteran-focused pages/groups with 
administrators from Kosovo. 


In order to join the Facebook group, a user 
must answer the prompt “where were you 
stationed at” before an admin or moderator 
approves membership (Figure 56). Facebook 
users can request membership in the group 
while interacting via their personal account, 
or through a page for which they are an 
administrator. VVA’s official page requested 
membership, which was denied — though a 
request for membership using the personal 
account of the author of this report was 
approved. Once membership in the group 
is granted, users can see all posts by other 
members of the group. 


This membership-request question is the 
first point at which the Russian and Bulgarian 
entity are able to solicit personal information 
from individual veterans. The information 
could later be used as ammunition 

for additional personal targeting for 
disinformation, impersonation, and other 
types of fraud. 


Despite the deception of the Bulgarian and 
Russian admins, within the group there is 

a genuine and organic sense of community 
among American veterans. Vietnam veterans 
frequently share photos and videos related 
to the Vietnam war and are looking to 
reconnect with the people with whom they 
served. The content and comments are 
generally apolitical and are shared in good 
faith from a variety of sources: personal 
photos, as well as other public Facebook 
pages and posts. Some apparently actual 
Vietnam veterans seem to visit the group 
and post multiple times per day, often with 
lighthearted jokes and personal stories. 
They post positive news articles, such as 
coverage of the recently enacted expansion 
of caregiver benefits. Vietnam veterans in 
the group share touching memorials for lost 
friends and heartfelt tributes to Prisoners of 
War and those Missing in Action. 


An authentic, positive community 
atmosphere is what veterans seek out online, 
and foreign entities are taking advantage of 
this. As a community, these veterans along 
with the recruited moderators seem to have 
made genuine efforts to purge the group 

of identifiable spammers, trolls, and non- 
veterans. However, the thousands of veterans 
in this online community are completely 
unaware of the fact that Bulgarian and 
Russian administrators have control of 

the Facebook page and that the foreign- 
controlled page acts as the administrator 

for the group. The volunteer moderators, 
who appear to have authentic personal 
accounts, have limited control over the page. 
The administrator privileges maintained 

by the Bulgarians and Russians who run the 
“Veterans of Vietnam” page supercede the 
privileges of the recruited moderators. 


The veterans in this online community are 
unaware that the photos and stories they 
share can then be harvested by the Bulgarian 
and Russian admins for use as propaganda. 
These unsuspecting Facebook users don't 
understand that when sharing their content, 
this material can be used by foreign admins 
to gain credibility and deceive American 
audiences. 


Despite the “Veterans of Vietnam” Facebook 
page's relative recent inactivity, the Bulgarian 
and Russian admins may still be quietly 
observing the community within the group 
to monitor what content draws the greatest 
or most divisive responses. Thanks in part 
to the restrictive private-group settings, 
they could potentially experiment with 

new tactics, techniques, and procedures, or 
TTPs, on these Vietnam veterans to test and 
develop more effective subversive activity, 
either through the page or via imitative or 
sockpuppet accounts meant to appear as 

if they belong to individual, real Vietnam 
veterans. 


(text continued on page 60) 
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Overview 


With the central Vietnamese city of Da Nang having fallen in March, and with Saigon under attack and being shelled, on April 3, 1975, U.S. President Gerald Ford announced 
that the U.S. government would begin evacuating orphans from Saigon on a series of 30 planned flights aboard Military Airlift Command (MAC) C-5A Galaxy and C-141 
Starlifter cargo aircraft. 


Service organizations including Holt International Children's Services, Friends of Children of Viet Nam (FCVN), Friends For All Children (FFAC), Catholic Relief Service, 
International Social Services, International Orphans and the Pearl S. Buck Foundation petitioned the government to help evacuate the various orphans in their facilities in 
Vietnam. In their book, Silence Broken, Childhelp (International Orphans at the time) founders Sara O'Meara and Yvonne Fedderson chronicle their request from Lieutenant 
General Lewis William Walt to help with evacuations and finding homes for the Asian-American orphans. 


Flights continued until artillery attacks by North Vietnamese Army and Viet Cong military units on Tan Son Nhut Airport rendered airplane flights impossible. 


A pair of well-worn baby shoes 


worn by an orphan evacuated from 
the evacuation was in the children's best interest, and because not all the children were orphans. Vietnam during Operation Babyllift 


When American businessman Robert Macauley learned that it would take more than a week to evacuate the surviving orphans due to the lack of military transport planes. he 


chartered a Boeing 747 from World Airways and arranged for 300 orphaned children to leave the country, paying for the trip by mortgaging his house. 


Over 2,500 children were relocated and adopted by families in the United States and by its allies. The operation was controversial because there was question about whether 


Frederick M. "Skip" Burkle, Jr. served as the medical director of Operation Babylift. He gathered the orphans in Saigon, accompanied them to Clark AFP in the Philippines, and continued to care for them on the 
Boeing 747 across the Pacific Ocean to Los Angeles. 


Plane crash 


Main article: 1975 Tan Son Nhut C-5 accident 


A C-5A Galaxy, serial number 68-0218, flew the initial mission of Operation Babylift departing from Tan Son Nhut Airport shortly after 4 p.m. on April 4, 1975. Twelve minutes after takeoff, there was what seemed to 
be an explosion as the lower rear fuselage was torn apart. The locks of the rear loading ramp had failed, causing the door to open and separate. A rapid decompression occurred. Control and trim cables to the 
rudder and elevators were severed, leaving only one aileron and wing spoilers operating. Two of the four hydraulic systems were out. The crew wrestled at the controls, managing to keep control of the plane with 
changes in power settings by using the one working aileron and wing spoilers. The crew descended to an altitude of 4,000 feet on a heading of 310 degrees in preparation for landing on Tan Son Nhut's runway 25L. 
About halfway through a turn to final approach, the rate of descent increased rapidly. Seeing they couldn't make the runway, full power was applied to bring the nose up. The C-5 touched down in a rice paddy. 


Figure 59: This is the Wikipedia page that was plagiarized by VeteranLegacy.com for the “What Was Operation Babylifte” 


article. 
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Figure 60: “Veterans of Vietnam” often shared the same content multiple times, yet because these articles appeared to 
come from a legitimate source of information, they continued to benefit from shares with each post. 


(text continued from page 58) 


Creation of an Online 
Ecosystem: Russian and 
Bulgarian Admins Have 
Websites Dedicated to 
Adding Legitimacy to Their 
Facebook Page 


The “Veterans of Vietnam” entity is 

not limited to a presence on Facebook. 
The admins appear to have built three 
websites exclusively to develop written 
content for the Facebook page. Blog- 
style posts were made on VeteranLegacy. 
com,” AllAboutVietnamWar.com,°?® and 
VietnamVetsCorner.com on topics that 
Vietnam veterans frequently engage with. 


Only VeteranLegacy.com remains online 

in its original form with easily accessible 
records via the WHOIS service, which 
reveals that the page was registered through 
GoDaddy.com on December 7, 2015.99 The 
other two pages appear to have been taken 
down and their records possibly scrubbed, 


perhaps by their respective admins or by 
their website’s registrar. 


These three websites appear to have been 
actively developing new, original content 
from December 2015 until April 18, 2017, but 
there have been no posts since. It is unclear 
what may have triggered this period of 
Inactivity. 


For historical context: April 18, 2017, was 

one month before Special Counsel Robert 
Mueller was appointed by Deputy Attorney 
General Rod Rosenstein to investigate 
Russian interference in the 2016 election, so 
there is no reason to believe that the Mueller 
investigation led them to cease operations.! 
While other Russian pages identified in the 
Mueller report were paying for Facebook 
ads through May 2017, the “VeteranLegacy. 
com” page never purchased any ads, so it 
likely faced far less scrutiny. April 2017 was 
also five months before VVA began publicly 
combating the first Bulgarian entity that 

we discovered creating impostor pages and 
websites. 


Veteran Legacy 


Posted On February 13, 2017 | Posted By Admin | Posted In Uncategorized 


If you're a Vietnam War veteran and 
have yet to apply for a VA home loan, 
you may be wondering whether or not it 
would be a good choice to apply for 
one. There are a couple of things you 
may not yet know about a VA home 
loan, and these points could influence 
= your decision on whether to apply for a 
Dak To, Vietnam. An Infantry patrol moves up to ~—|oan. Below are some of the things you 
assault the last Viet Cong position after an should know about VA home loans. 
attempted overrun of the artillery position by the 
Viet Cong during “Operation Hawthorne.” June 7, Firstly, VA loans are meant to be used 
1966. (National Archives} for specific types of homes, such as 
condos, modular housing, single-family 
homes, and other types. So if you are looking to purchase a farm or fixer-upper, then 
applying for a VA loan will not be of much help. Another thing you should know about 
VA home loans is that the VA does not originate them. Rather, it is an agency that 
will provide a guaranty. However, the VA home loans are backed by the federal 
government, therefore you will be able to secure lower interest rates. You should 
also note that VA loans are reusable. This means that as long as you have a VA loan 
entitlement, you will be able to use it as many times as you want, given that you are 
able to pay off your loans. You can also get a new VA loan if you have lost your old 
one due to foreclosure. 


On another note, you should know that VA loans require a mandatory fee known as 
a funding fee. This funding fee assists the VA in continuing the VA loans programs. 
The funding fee is typically about 2.15% of your total loan amount. Whether you are 
looking for a purchase loan or a refinance loan, there will be a required funding fee. 
Vietnam War veterans with service-connected disability, however, will not be required 
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Figure 67 


However, April 2017 was the month that 
Facebook published a report on how to 
identify “Information Operations” on social 
media, which may have driven these admins 
underground." 


Unlike the Bulgarian entity affliated with the 
vvets.eu and vietnam-veterans.org websites, 
the “Veterans of Vietnam” entity appears to 
have refrained from simply copying-and- 
pasting entire articles from MilVet-focused 
news and VA websites. Some articles appear 
to be unique, while others are largely 
plagiarized from Wikipedia and other online 
sources. The free online plagiarism tool 

from PapersOwl.com was helpful for tracing 
content posted on the website VeteranLegacy. 
com to its original source!”? (Figures 57-59). 
One plagiarized resource that we found was 
particularly suspicious. The text of the post 
“Why Vietnam War Veterans Should Apply 
For A VA Home Loan” by VeteranLegacy. 

com posted on February 13, 2017,'°? appears 
to have been at least in part lifted from the 
Russian website!** Knowledgebook.ru (among 
other sources) (Figures 60-68).!° 


Knowledgebook.ru’s website is still working, 
but their afhliated Twitter!°® account and 


Facebook page!” have both been suspended, 
which could indicate that these social- 
media accounts were connected to a known 
disinformation campaign. The text of the 
Knowledgebook.ru page that corresponds 

to the VeteranLegacy.com article appears 

to have originally been written by an India- 
based content-marketing specialist,!0°!090 
who published an identical article for 

the American-based website WealthHow. 
com. WealthHow.com!"" is a division of the 
American company Buzzle.com, Inc, a guest- 
blogging network that is headquartered in 
California." 


In other words: Benign content created in 
India for an American company’s website was 
plagiarized by what evidence suggests may be 
a Russian disinformation website. A Russian- 
and-Bulgarian-based entity then used this 
plagiarized content to deceive Americans 

on Facebook into believing that the Russian 
and Bulgarian admins were actually 
American veterans of the Vietnam War who 
were spreading useful information about 

VA benefits. Posting about VA benefits was 
done to build an audience that trusted the 
deceptive foreign admins, who could later 
use that audience to spread disinformation, 
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harvest data, and inflame Americans’ political 
divisions. 


VeteranLegacy.com articles and “Veterans of 
Vietnam” Facebook posts have been shared 
both by authentic MilVet-focused social- 
media accounts, as well as those that appear 
to be controlled by foreign entities. Notable 
posts of VeteranLegacy.com articles by 
Facebook pages other than the “Veterans of 
Vietnam’ are described below:"2 


l. The VeteransLegacy.com article “The 
Myth That The War In Vietnam Was Not 
As Intense As World War II" was posted 
a total of 28 times on social-media pages 
and received a total of 651 shares.!" 


1.1 On July 8, 2017, the Facebook page 
“America’s Veterans Are Loved” shared 
a “Veterans of Vietnam” Facebook 
status,!'© with the article “The Myth 
That The War In Vietnam Was Not As 
Intense As World War II.” From this 
single post by the “America’s Veterans 
Are Loved” page, the status and article 
received 28 additional Facebook shares. 
The page also shared several other 
statuses and articles from “Veterans of 
Vietnam.,’!!” 


“America’s Veterans Are Loved” was 
created on November 21, 2014, and has 
four admins in the US — according to 
the page’s Info and Ads tab — though 
grammatical and spelling errors in 
certain posts raise the possibility that at 
least one of these admins is not a native 
English speaker. This page has shared 
content developed by the Russian page 
“Being Patriotic,’ both before!"® and 
after"? the 2016 election, though that 
may have been done unknowingly 

by Americans. The page has 323,602 
likes, and it posts multiple times each 
day. The page shares statuses and 
articles from a variety of reputable 
news sources, as well as partisan right- 
leaning outlets and content producers. 
Recent political content attacks 
President Trump's critics,!?° while 
content from the days before the 2016 
election endorsed candidate Trump”?! 
and attacked Secretary Hillary Clinton 
at length.’”? The page ties Secretary 
Clinton to the Black Lives Matter 
movement (BLM), saying that together 
they want to “ban” the American flag.!”° 
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The page refers to MSNBC, CNN, VOX, 
ESPN, the New York Times, WSJ, NBC, 
and CBS as “domestic terrorists.”!*4 The 
page also shared some of the same 
content as the Bulgarian entity, such as 
the barn photo, displayed in Figures 15 
and 16. This suggests that foreign and 
domestic pages share common sources 
of content or are copying one another. 


2. The VeteranLegacy.com article “Lessons 
From Vietnam War’! was posted six 
times, and received 172 total shares on 
Facebook. 


2.1 On January 8, 2016, the Facebook 
page representing the nonprofit 
Veterans4Warriors!”® shared a 
Veterans of Vietnam status!?’ with a 
VeteranLegacy.com article (Figure 64). 


2.2 On January 10, 2016, the Facebook 
page “Veterans Nation,’ with 198,763 
likes, shared!”8 a VeteransLegacy article. 
This post was then shared 17 additional 
times from the “Veterans Nation” page 
(Figure 65). The “Veterans Nation” 
page was created on January 4, 2015, 
and according to the Info and Ads tab 
at the time of this investigation had 
15 admins operating from Vietnam. 
This is a page that we have monitored 
and documented for several months. 
A screen-capture of this page on 
September 12, 2018, shows that at 
that time it had eight admins in 
Vietnam, one admin in Brazil, and 
one admin in Ukraine (Figure 66). 

A second screenshot dated October 
15, 2018, shows this page having 

nine admins in Vietnam (Figure 67). 
These irregularities may be a sign 

of international efforts to deceive 
American veterans — otherwise, it 
could mean that admins are able to 
spoof their location and trick Facebook 
into displaying a country of origin 
that does not match their geographic 
location. 


(text continued on page 64) 
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Figure 62: The text from the “Why Vietnam War Veterans Should Apply For A VA Home Loan’ article on the 
VeteranLegacy.com website is entered into the plagiarism checker on PapersOwl.com. The plagiarism checker 
determined that as much as 24.9 percent of the text was lifted from the Russian website knowledgebook.ru. 
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things to consider before applying for a va loan 


Things to Consider Before Applying for a VA Loan 


Due to the nature of their work, people from the military go through distinct financial troubles. Their constant traveling compels other members in their family to keep up a steady 
employment, which is why this Buzzle article discusses the Veterans Affairs (VA) loan program in detail. 


According to Military.com, the VA wants home buyers to have a debt-to-income ratio which will not be more than 41% and enough residual income in order to pay for the living expen 
A VA loan is a mortgage loan established by the United States Department of Veterans Affairs for providing home loan benefits to veterans, active servicemen, surviving spouses, an 
families. This does not mean that the VA gives out the loans. The loans are provided by private lenders, while the VA guarantees a certain part of the loan. This helps get better cost 


and terms of repayment. Also, as they do not have mortgage insurance, you are able to save a lot of money every month. Remember that these are not one-time loans; in fact, these 


are reusable and you can avail another, once you pay off the earlier one. The best part about this loan is that if you fail to pay your mortgage, the VA will step in and negotiate with thq 
for better terms. Also, pre-payment of dues does not attract any penalty. Hence, because of all these benefits, availing this loan can be very advantageous for you. However, you mus 
certain things before you plunge into one. For example, there is an occupancy rule which is applicable to the VA loan. 

Things You Should Know Before Applying for a VA Loan 

+ Primary home will get preference over your second home. In all probability, lesser important loans for second home, vacation homes, and beach houses which will not be occupied 
may not get approval easily. The main purpose is to cater to the housing requirements of the veterans or their family. It does not support giving away loans for additional homes whic 
more or less a luxury or investment-oriented. Hence, do not forget to mention that you will be occupying the house after a short duration of time. Also, they are usually given for a sing 
home, and a fixed upper home or working farm may not get approved for the loan. 

+ Civilian co-borrower's share of VA loan will not be VA guaranteed. If you want to apply for a joint loan, you are entitled to do so. However, if you are a veteran and your co-borrowe 
civilian, the latter's portion of loan will not be guaranteed by the Department of Veterans Affairs. However, the VA will guarantee the loan if the co-borrower and you were previously o 
currently recruited in the military. Your spouse or another veteran will be acceptable co-borrowers. Remember that in joint VA loan applications, the civilian co-borrower will have to cd 
a number of formalities and submissions to the lender. This may include his income, tax documents, credit report, details of any other property owned with the veteran, etc. 

+ Your credit rating will impact your loan. Although the Department of Veteran Affairs will not exercise a credit score requirement, lenders are on the lookout for a credit score that is ¢ 
higher. Like the other types of loans, it is important that you have a good credit score for availing the benefits. As the lending institution will go through your credit history, it is importa 
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Figure 64: “Vets4Warriors’, a legitimate veterans organization, unknowingly shared Russian-generated content. 


(text continued from page 62) 


The afhliated website VeteranNations.com 
makes contradictory claims regarding the 
business's origin. On one single page of 
the website, VeteranNations.com says it 

is headquartered in “California, USA,’ with 
“specialty items in other countries such 

as the United States, United Kingdom, 
Germany and China’ and their main 
warehouse in Vietnam.'?? The promotion of 
this website and sales of MilVet-related 
trinkets appears to be the primary purpose 
of the “Veterans Nation” Facebook page, 
though this could be a ruse to build an 
audience that will later be inundated with 
propaganda. 


The page created the Facebook group 
Veterans Nation - Honoring All Who 
Served on June 26, 2018, which now 

has 10,206 members.!°° It also has an 
afhliated Instagram account 
“@usveteransnation, which has in the 
past shared content produced by the 
Russian entities Veterans Come First,!*!!°? 
and Being Patriotic several times (Figure 
G8), 188.184.1885 


The only personal account that also 
has administrator privileges for the 


Facebook group appears to be a fake 
Vietnam-based account operating under 
the pseudonym “Kelvin Henry.”!° This 
personal account is made to look like it 
belongs to a male American veteran and 
uses various uploads of patriotic and 
military-themed graphics, but originally the 
account began with a female model's image 
for its profile photos. The account also “likes” 
several obscure Vietnamese pages. 
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Figure 65: “Veterans Nation” shared content that was developed for the Russian and Bulgarian page “Veterans of 
Vietnam,” though it is unclear if this was coordinated between the two pages. 
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Figure 66: “Veterans Nation” does not share admin countries of origin with the Russian and Bulgarian “Veterans of 


Vietnam” page, but it does have an unusual collection of admins that span three continents with very different cultures 
and native languages. 
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Figure 68: The Instagram account that is associated with the “Veterans Nation” Facebook page is “@usveteransnation.” 
This instagram account has shared Russian-generated content, including from the IRA-affiliated page “Being Patriotic.” 
Note how the logo on the top /eft alters the name to Veteran Nations; this kind of discrepancy is common in fraudulent 
accounts, websites, and Facebook pages. 
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CHAPTER 3: Creation of Fake Veterans 


Organizations 


While Vietnam Veterans and VVA have 
specifically been targeted by foreign-born 
impostors in cyber-environments, the 
broader MilVets community is targeted as 
well. Foreign elements have created fake 
organizations that are designed to appear 

as if they provide services to MilVets, are 
“organic” communities (grown through 
unpaid posts and comments) of American 
MilVets, and are afhliated with real MilVet 
organizations. They accomplish this by using 
names, websites, logos, and symbols that are 
recognized and trusted by MilVets and the 
broader American public. 


“We Are Veterans” and “We 
are Veterans” 


“We Are Veterans” (with capitalized “A” in 

the word “Are”)'®’ is a foreign-born impostor 
Facebook page that is made to look like it 

is affliated with the legitimate American 
organization We Honor Veterans (Figures 69 
and 70). 

“We are Veterans !°° (with lowercase “a’ in the 
word “are’) is also a foreign-born impostor 
page that attempts to use We Honor Veterans 
to build its credibility. 


The real organization We Honor Veterans 

is headquartered in Alexandria, VA, and 

is a program of the National Hospice and 
Palliative Care Organization (NHPCO). 

We Honor Veterans works in collaboration 
with the Department of Veterans Affairs 
with the honorable mission of ensuring 
that veterans in hospice care do not die 
alone.!8° The organization's logo consists of 
a V, the left half of which is a solid-blue field 
and the right made up of four red stripes, 
which evokes an image of the American flag. 
Partially above the V and between its two 
halves is a gold star. 


The “We Are Veterans” Facebook page uses 
the blue and red “V” from the We Honor 
Veterans logo, swapping the gold star fora 
gold silhouette of the profile of a bald eagle 
with wings and talons outstretched.'”° 


The “We Are Veterans” Facebook page was 
created on March 14, 2017, and all nine page 
admins are based in Vietnam. It currently has 
67,248 followers. The “About” tab includes 
non-native English and reads: “Our site is 
legit and it’s located in U.S. Therefore, all of 
our items are printed in USA. Thank veterans 
who has had long service or experience 

in a particular occupation or field /szc/”” To 
confuse matters, the website on the “About” 
page belongs to the legitimate We Honor 
Veterans organization, but rather than link to 
the homepage, it links to We Honor Veterans’ 
PowerPoint repository." 


“We Are Veterans” has posted known 
Russian-generated content, such as memes 
developed by “Veterans Come First” (Figure 
73) and “Remember.Military.” The page 
appears to have started with a focus on 
selling memorabilia, but recent activity 
indicates that the page is now just focused on 
building an audience. 


The “We Are Veterans” page has shared 
explicitly political content, though 
considering it is entirely controlled by 
admins outside the US, it’s unclear why 

this does not violate Facebook's policies 
regarding foreign interference in political 
campaigns. The first pro-Trump meme that 
was shared by this page was posted June 14, 
201914? (Figure 71). A second pro-Trump post 
on June 28, 2019, using the slogan “Make 
America great again!” quickly garnered 150 
shares"? (Figure 72). “We Are Veterans’ has 
also run ads deemed to be “about social 
issues, elections, or politics” (Figure 74). One 
of these ads was removed for a violation.“ 
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by the foreign-born “We Are Veterans” Facebook page. 


“We Are Veterans’ has not relied on a single 
online store, like many similar pages. Instead, 
it has shared links to several different online 
stores, including paid ads for the following 
links: 


https://zalooo.com/products/blnvit 
https://zalooo.com/products/ttbmm 
https://helutee.com/believ 
https://helutee.com/vetpra 
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https://bit.ly/20QWmr6 
https://helutee.com/alusma 
https://helutee.com/mrjob 
https://helutee.com/marineiam 


COON AOR OND 


In between selling merchandise deemed by 
Facebook to be “of political importance,’ the 
page has also been posting known-Russian- 
IRA created memes.'*° 


Figure 69: This is the original logo of the legitimate organization We Honor Veterans, which was modified and co-opted 





The “We are Veterans’ (with the lowercase 
“a’) Facebook page has only one admin, who 
is based in Vietnam." The page was created 
on February 26, 2016, with the name “We are 
a Veteran,’ which indicates that it was created 
by a non-native English speaker. The page 
was later renamed to “We are Veterans” on 
August 18, 2016. The page’s m.me URL’ is 
“wehonorveterans.us/, 4°49 which is meant 
to make people believe that it is associated 
with the legitimate wehonorveterans.org 
website. “We are Veterans” has 118,686 
followers. 
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Figure 7/0: “We Are Veterans” ripped off a logo for We Honor Veterans. 
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Figure 7/1: “Vote Trum[p]’ is watermarked in the photo. The stock image in this photo, featuring Marine veteran Aaron 
Mankin (right), has also been used by the known-/RA entity Tea Party News. 
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Figure 7/2: The Trump campaign's “Make America great again” (MAGA) slogan was shared in the comment with this post. 
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CHAPTER 4: The Content Used by Foreign 
Admins to Build an Audience Focuses on 
American Veterans and Then Works to 


Divide Us 


The United States military has consistently 
been among the most trusted American 
institutions,!©° and it is unique in size and 
scope among organizations that bring 
together Americans of diverse backgrounds. 
Military service facilitates strong bonds 
among Americans who otherwise would 
never have met one another, and the internet 
allows them to remain in contact long after 
they've served together. While the diversity 
of the American military along racial, ethnic, 
economic backgrounds, academic disciplines, 
and political afhliations is its strength, it 
also provides fault lines to be exploited by 
our adversaries. 


While much of the public focus regarding 
foreign interference with the 2016 election 
was centered on the divisive and overtly 
political messages that were published, most 
of the activity that these foreign entities 
engage in is simply audience-building. After 
studying the behavior of legitimate American 
VSOs and veteran-owned small businesses, 
these foreign entities have become 
exceptionally skilled at reproducing branding 
and content that earns MilVets’ attention. 
These foreign interlopers recognize that 
photographs of celebrity veterans, wounded 
servicemembers, and flag-draped caskets 
often draw responses in terms of likes, shares, 
and follows from their audience. 


The primary objective of online foreign- 
influence campaigns is to sow “discord 

in the U.S. political system, %? which has 

the effect of weakening faith in American 
government both domestically and abroad. 
In order to accomplish this objective, the 
hostile accounts must carefully balance 
relatively benign audience-building behavior 
with the divisive content that incites 
negative reactions (but also risks attracting 
the attention of investigators — or turning 
off followers). The most effective divisive 
content has a net effect of audience-building, 
as angry reactions online (comments/ 
arguments, shares, “angry face” emoticons, 


etc.) are rewarded by social-media 
algorithms — pushing the post into the 
newsfeeds of Americans sympathetic to the 
divisive message and creating a reward-for- 
outrage feedback loop. 


Audience-Building Content 


Audience-building content takes several 
forms, with the goal of creating a brand 
that piques interest and builds rapport 

and loyalty. The most common form of 
audience-building content is the “positive 
meme, which is designed to evoke good 
feelings such as camaraderie, sympathy, 
and celebration. In the context of MilVets, 
the positive meme may incorporate generic 
messages with slogans like “Land of the free 
because of the brave, thank you veterans”! 
or engagement-bait such as “WERE 
VIETNAM NURSES HEROES?’ or “I leave 
my family to protect yours CAN YOU GIVE 
ME AMEN AND A SHARE?’ (Figures 75 and 
76),154 


More-targeted engagement-bait content 
leans on language and imagery that is specific 
to American MilVet culture. These admins 
often post memes displaying pictures of 
military equipment asking followers if they 
have ever used the item. This can range from 
the P-38 Military Can Opener’ (Figure 77) 

to M18 Claymore Anti-Personnel Mines! 
(Figure 78). 


The admins frequently share memes that 
include common phrases from MilVet 
culture or inside jokes like the “hooah” 
soldier Carl. Foreign entities also post news 
and information relevant to MilVets, such 

as changes in military benefits or “how- 

to” guides on using the VA. These positive 
memes commonly link to the sales of 
MilVet-themed merchandise through opaque 
third-party websites. 


(text continued on page 77) 
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Figure 7/7: “Vietnam Veterans” uses a link-shortener to disguise links to their store in their posts. 
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Figure 79: Divisive content can include racially inflammatory phrases. 


(text continued from page 74) 


Divisive Content 


Divisive content is developed with two target 
audiences in mind: The first target audience 
consists of those who sympathize with the 
content’s message and are likely to share it, 
spreading it across social-media platforms. 
The second target audience, on the other 
hand, consists of those who will reject the 
message and respond heatedly and negatively 
toward the first target audience. The primary 
purpose of these foreign accounts is to 

create conflict and deepen divisions among 
Americans (Figure 79). 


Categories of MilVet Content 


Historical photographs 


Malignant entities such as “Veterans of 
Vietnam” frequently harvest publicly 
available authentic photographs from 
Vietnam veterans, veteran advocates, VSOs, 
news publications, and historians — and 
then post them as original content on their 
Facebook page. They are often posted 
without being made into a meme, and witha 
caption describing what is in the image.’ 


This type of content harvesting is made 
easier when these entities control private 
Facebook groups, such as the “Veterans of 
Vietnam” Facebook page’s American Veterans 
of Vietnam Facebook group,’ where these 
photos are both solicited and organically 
shared among a community of real Vietnam 
veterans. 


It can sometimes be difficult, however, to 
tell if Facebook users that regularly post and 
share within these foreign-controlled groups 
are authentic, or if some of the individual 
accounts are wholly or in part under the 
control of foreign elements who are engaging 
in predatory audience-building behavior in 
coordination with the group’s and afhliated 
page’s admins. Suspicious behavior from 
individual accounts within the groups can 
include: apparent non-veterans constantly 
posting MilVet-related content; content being 
shared outside of daytime-hours within the 
US; content consistently posted quickly in 
batches and only around the same time each 
day; posts that have awkward or inconsistent 
use of punctuation; use of content that is 
identical to, or modified from, confirmed 
Russian disinformation sources; and content 
that is repetitively posted by the same 
accounts as if it were new. 

(text continued on page 80) 
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Figure &2: This meme featuring Kirstie Ennis in a hospital bed is watermarked with “World USA,” and includes the handle 
@combat_badassery. [hese markings allow admins to track other social-media accounts that are reposting the meme 
as original content. 
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Figure 83: There are hundreds of MilVet and law-enforcement memes that feature distinctive yellow and orange text like 
this one, which suggests a common original source or repository of this content. Memes with this style of text frequently 
include spelling and grammatical errors indicative of a non-native English speaker. 
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(text continued from page 77) 


To be clear, these are not definitive signs 
of inauthentic accounts — but activity that 
raises suspicions for investigators. 


Use of Prominent Servicemembers 


Army Sergeant Major Marilyn Gabbard 
(Figure 80), who was killed in Iraq in 2007, is 
a favorite of these foreign admins. Marine 
Corporal Aaron Mankin (Figure 71), Marine 
Lance Corporal Kyle Carpenter (Figure 81), 
and Marine Sergeant Kirstie Ennis (Figures 
82 and 83), all severely wounded in post- 
9/11 wars, have become some of the most 
frequent subjects of memes created and 
used by foreign admins to build an audience 
for their fraudulent social-media pages and 
accounts. 


Marilyn Gabbard 

Ms. Gabbard was the first woman promoted 
to the rank of command sergeant major 

in the Iowa National Guard and was a 
trailblazer for young enlisted women in the 
military.° She was an active member of the 
community of military and veterans service 
organizations, having served as the national 
secretary for the Enlisted Association of the 
National Guard of the United States, as well 
as president of the Enlisted Association of the 
Iowa National Guard, and as president of the 
Iowa Sergeants Major Association.'©° She was 
killed in Irag in 2007 when her helicopter 
crashed. 


Aaron Mankin 

Marine Corporal Aaron Mankin (Figure 

71), Marine Lance Corporal Kyle Carpenter 
(Figure 81), and Marine Sergeant Kirstie 
Ennis (Figures 82 and 883), all severely 
wounded in post-9/11 wars, have become 
some of the most frequent subjects of memes 
created and used by foreign admins to build 
an audience for their fraudulent social-media 
pages and accounts. Mr. Mankin was serving 
as a combat correspondent in Iraq in 2005 
when his vehicle was hit by an IED, killing six 
men.'* The resulting burns scarred most of 
his body, but after being medically retired, he 
has become a tireless advocate for post-9/11 
veterans and was recognized in 2010 among 
People magazine's “Heroes of the Year.”!® 


Kyle Carpenter 

In 2010, as his unit was being ambushed 

by the Taliban, a grenade was thrown 

into a sandbagged defensive position that 
Mr. Carpenter and a fellow Marine were 
occupying. Mr. Carpenter threw his body 
onto the grenade just before it exploded, 
absorbing most of the shock and shrapnel — 
saving the lives of his colleagues in a selfless 
act of bravery. He was awarded the Medal of 
Honor for his actions.!® 


Kirstie Ennis 

Ms. Ennis was serving as a Marine in 
Afghanistan in 2012 when she was injured 

in a helicopter crash that left her with a 
traumatic brain injury, spinal trauma, and 
an amputation of the leg above the knee, 
among other injuries.!** Ms. Ennis’s road to 
recovery has been thoroughly documented 
in both social media and the press, and she 
has inspired countless people as she climbed 
Mount Everest and continues to engage 

in demanding physical activities without 
limitation. She was the first-ever war veteran 
to be featured in Sports Illustrated's “Body 
Issue. 


Each of these stories of bravery, sacrifice, 
and recovery has been callously co-opted 
by foreign admins to take advantage of the 
sympathies of Americans and deceive them 
for nefarious online purposes. 


Chris Kyle 

Chris Kyle is a particularly outrageous case 
of co-opting prominent veterans to delude 
Americans because memorial pages based on 
him were specifically targeted by Russian ads, 
and there are a variety of pages dedicated 

to him with foreign admins — including 
admins located in Iran and Pakistan (Figures 
84-89). 


(text continued on page 87) 
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Figure 84: The Facebook page “Honoring our American Heroes” has four admins in the US and five others in different 
countries. 
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Figure 85: This page has changed names twice, though its primary focus remains on Chris Kyle. 
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Figure 86: Chris Kyle is often exploited by pages with foreign admins to sell merchandise. 
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Figure 87: Chris Kyle’s name and photos are used frequently by several pages with foreign admins. While the “Honoring 
our American Heroes” page (above) has admins in the US, Indonesia, Iran, Malaysia, the Philippines, and Vietnam — the 
admins of this page, “In Memory US Troops,” are based in Pakistan and Thailand. 
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Figure 90: The Gold Star wife featured in this screenshot has appealed to the public to stop using this photo as a 
political meme. Unfortunately, this request has no impact on the dozens of foreign admins who have posted this meme 
on their fraudulent pages or the thousands who have shared it. 
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Figure 91: This Gold Star wife and son are being exploited by the Facebook page “Vietnam Veterans’ to sell knives. 





84 


ee 


CHAPTER FOUR 


Veterans Nation 
e?8 2015 -% 


@ 407 3 Comments 117 Shares 


1) Like (J Comment > Share a ~ 


Most Relevant * 


Figure 92 


To all the overpaid kneelers in the NFL: 
Put on this uniform, then you might 
understand why we stand. 


RY NLGING, HERO GET/A)RE 


oll, 


Teas ST aa | | 


Figure 93 








BE ery proud of u need more of 
the same inthis America honor and 
respect god bless u for ur loss my this 
veteran rip 


Like - Reply : 4y 0: 
PS Fo 2) respect. First ta his 


dad and being a MARINE. THANK YOU ta 
the family and him for his service. 


Like - Reply - 4y ©? 
Semper fidelis young 


marine, sorry for your loss, your father's 
very proud of you. Sgt D. 


Like - Reply - 4y 


New release! Check out our custom Vietnam 
memorial knife here: http://clickaleys.com/ 
vietnam-veteran-memorial-knives 


© + 760 #33 Comments 
456 Shares 


a Like (J Comment a Share a ~ 


Most Relevant F 


BE | hank you God Bless you 
"A 5 


oe 
teva ‘4 


Like - Reply - ly 


1@ ammo 


Like - Reply - ly 


EE God Bless you rest in peace. 


Thank you for your service and sacrifice 


Like - Reply - ly 


@ ite a comment 


85 


~~ Veterans Nation 


tp 1015 - 


Thank you SERVING In the U.S. Military ! 
And Best T-shirt For Only Veteran at : 
teespring.com/hxavet?var=fp 


Ox 159 15 Comments 38 Shares 


0 Like () Comment > Share a~ 


Most Relevant * 


I'm Ret USN "SEMPER 
FI" R.I.P. 


MATTHEW 5:9 BLESSED ARE THE 
PEACEMAKERS : FOR THEY SHALL BE 
CALLED THE CHILDREN OF GOD. 


Like - Reply - 4y 


Veterans Nation Hi Russe 
Taliaferro , Thank you SERVING In 
the U.S. Military ! 

And Best T-shirt For Only Veteran 
at : teespring.com/hxavet?var=fp 


EESPRING.COM 
[ONLY 2 HOURS 
ae LEFT]-A... 
ity 


Like - Reply - 4y 


Very said 
pic.R.1.P. SIR. 


Like - Reply - 4y - Edited © 


Veterans Nation Yes & . And 
Thank you SERVING In the U.S. 
Military ! 

And Best T-shirt For Only Veteran 





Figure 94 


Vietnam Veterans 
2016 - 2 


Absolutely say "Yes" - Is that right, my vets? 


OVOe 231 26 Comments 342: 
[.) Like (J Comment > Share 


Most Relevant * 


2!) ves 
; 1 
Like - Reply - ay 0 


[| Ohhh yeaaga!!! 
oO: 


Like - Reply - 2y 


a * 


Like - Reply - ty 


SC 


Like - Reply» 2y 


BE (clude in that all those they 


want to bring from the middle east they 
claim are refuges. Lots in previous 
pictures appeared to be 20 something 
able bodied guys. Looks like they could 
be a great start of an army potentially 
fight us. 





Figure 95 


86 


(text continued from page 80) 


Casket Photos 

Gold Star families have frequently been 
exploited by foreign admins who politicize 
photos of the families mourning over the 
casket of their fallen servicemember (Figures 
90-94). This entire investigation, in fact, was 
partly motivated by VVA’s attempt to help 
one widow who put out a public call to tell 
people on the internet to stop making her 
and her deceased husband into a political 
meme.!©6 As we attempted to discover the 
origin of the page of this offensive meme 
and report it to Facebook, we came to realize 
that it wasn’t just posted once — but multiple 
times on several different social-media pages 
and that many other Gold Star families were 
also being exploited in the same way. 


In numerous cases, these intimate 
photographs weren't being used just to build 
an audience or spread divisive political 
messages but also being used by foreign 
admins to sell merchandise. 


BuzzFeed News tech reporter Jane 
Lytvynenko reached out to Facebook about 
one of the pages that had been using these 
military-casket photos, and Facebook let 
her know that they immediately shut down 
the page — as well as eight other connected 
pages originating from Eastern Asia — for 
“inauthentic activity.’ 


Racist and Xenophobic Propaganda 


While there may be individual American 
veterans who subscribe to racist and 
xenophobic beliefs and are attracted to 
messages like “Veterans Before Illegals” or 
“Veterans Before Refugees” — there is not 
one single legitimate veterans organization 
that in any way endorses or promotes 
these messages. We, in fact, categorically 
reject them and seek to underscore that 
this false dichotomy is both harmful to 
veterans and our democracy as a whole. Yet, 
foreign admins have been promoting these 
hateful messages alongside posts that sell 
merchandise with our names and 

logos — misleading the general public 
about the positions maintained by our 
organizations (Figures 95-97). 
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Figure 107: Elderly veterans often have young friends and family who take photos like this one to help the vet reconnect 
with their long-lost battle buddies. Unfortunately, once these photos are co-opted by foreign admins, the hundreds of 
people who share the photo in good faith are only serving to spread the influence of the foreign trolls who are exploiting 
American veterans. 
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Figure 108 
(text continued from page 87) 


Antifa 


Memes featuring Antifa emphasize the most 
radical and threatening elements of the 
otherwise small and disorganized group of 
protestors (Figure 98). 


Obama vs. Trump in Respect for the 
Troops 


Several memes contain depictions of 
President Obama in situations that can be 
interpreted as disrespectful to MilVets, with 
photos that depict President Trump in the 
opposite way (Figure 99). 


Elderly Veterans Asking for Likes, 
Shares, and Respect 


Avery common and effective type of meme 
used by foreign admins features elderly 
veterans, usually holding handwritten signs 
(which are sometimes photoshopped after- 
the-fact) asking for respect or likes, or to 
help the subject reconnect with those with 
whom they served. These photos are never 
shared in a way that links to the subject of 
the photo — therefore separating them from 
any possible benefit of the well-meaning 


likes, comments, and shares garnered by the 
content (Figures 100-104). 


Kaepernick and the NFL vs. Troops 


Colin Kaepernick, the former National 
Football League quarterback who is credited 
with having started the kneeling-for-the- 
anthem campaign to raise awareness for 
police brutality and racism against African 
Americans in the US, is a favorite target 

of foreign admins who wish to exploit 

and amplify conflicts between Americans 

of different backgrounds and political 
persuasions (Figure 105). 


Exploiting KIAs, WIAs, and Mourning 
Servicemembers 


A particularly heinous exploitation of MilVets 
by foreign admins occurs when they share 
their mourning for those who have been 
killed or wounded in combat, or those who 
have died by suicide, while purporting to 
be among the Americans mourning. These 
foreign admins turn touching photos of 
heartbroken MilVets into clickbait that is 
meant to sell counterfeit merchandise and 
build audiences that they ll inundate with 
divisive political propaganda (Figures 106- 
116). 
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(text continued from page 94) 
Holidays 


Religious, federal, and cultural holidays are 
frequently exploited by foreign admins for 
clickbait memes involving MilVets. For pages 
that have not had their admin locations 


revealed because they have not yet purchased 


political ads or achieved a very large 
following, the holiday memes that are shared 
outside the appropriate seasons can tip off 
investigators to those controlled by foreign 
admins (Figures 117 and 118). 


Secretary Mattis Memes 


As a Marine Corps General, Secretary Mattis 
achieved a level of fame and appreciation 
among MilVets beyond that of any other 
high-ranking officer of the modern US 
military. Referred to lovingly by MilVets 

as the Warrior Monk for his reputation for 
being well read, as Chaos for his radio call 
sign, and Mad Dog by the press as a result 
of his brutal quotes, Mattis has become the 
inspiration for countless internet memes. 
As aresult, he has served as one of the 
most popular sources of engagement bait 
for foreign admins to build an audience of 
MilVets on social-media (Figures 119-122). 
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Exploiting Military Women 


This category includes women serving 
primarily in the American and Israeli 
militaries, though it is not uncommon to 
see women in uniforms representing many 
other countries — both allied and adversary. 
Content featuring women in uniform almost 
always highlights their gender, though it 
may be to exploit them in a sexual manner, 
to doubt their femininity or capabilities 

as servicemembers, or to celebrate their 
achievements as leaders. Regardless of the 
spin that foreign admins put on the content 
that features military women, memes of 
this category are often the most effective 
engagement-bait (Figures 123-1380). 


Exploiting Homeless Veterans 


Homelessness among veterans is a problem 
that is frequently pit against other problems 
that our society faces — creating a false 
dichotomy that if an individual supports any 
number of divisive issues, they therefore 
cannot at the same time support ending 
veteran homelessness (Figures 131 and 182). 
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Figure 124 





Figure 125 


While you carry a purse, she carries a 65/b 
rucksack. While you shop with your girlfriends, 
she cleans her rifle with her battle buddies. 
When you wear heels, she wears her combat 
boots. Instead of the make-up that you wear on 
your face to make yourself look pretty, she 
paints her face for camouflage. While you kiss 
your husband goodbye for the day, she kisses 
hers goodbye for the year. Don't forget about 
the women who serve our country and protect 
our freedom! God bless our troops! 
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Figure 129: While the men pictured in these memes are always in American uniforms, the foreign admins frequently 
exploit military women from other countries, especially Israelis. 
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Figure 131: Foreign admins often imply that purchasing their merchandise aids and assists veterans in need. 
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CHAPTER 5: What We Know About the 
Russian Ads That Targeted MilVets 


Evaluating the IRA Ads 


In October and November 2017, the United 
States House Permanent Select Committee 
on Intelligence (HPSCI) made available 
Facebook ads that were produced by the 
Russian IRA for the purposes of disrupting 
the 2016 election and dividing the American 
public in the wake of that election. 


There were at least ten times that ads also 
targeted Facebook users who identified as 
being in the United States Army Reserves. 


Facebook allows ad buyers to choose hyper- 
specific guidelines to define the population 
that the buyers want to target with ads. 
Ad-targeting criteria can be used to either 
include or exclude a host of biographical, 
geographical, social, or personal 
characteristics. 


The Content Russia Has Already 
Used to Target MilVets in Paid 
Ads 


The HPSCI provided ads that included both 
audience-building and divisive content, 
though the committee states that there were 
80,000 additional pieces of organic content 
that they obtained from Facebook and did 
not release. Organic content is that which has 
not been boosted to appear in people’s news 
feeds as paid ads.'® Of the 3,519 IRA-linked 
ads that the committee made available to 
the public, there were at least 118 instances 
of MilVet-focused ads purchased by the 
Russians.'©9 


(text continued on page 113) 
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of America 
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Topics 


Black solidarity / Identity / Rights 
Anti-Black-Lives-Matter, making references to “BLM 
terrorists” 

Latino solidarity / Identity / Rights 

Anti-Hispanic / Anti-Spanish-language 

Muslim identity / Rights 

LGBT Identity / Rights 

Anti-LGBT 

Iran killing Americans in Iraq 

Support for law enforcement 

Law-enforcement misconduct or failure 
Anti-government spending / Taxation 

Military mission failure in Vietnam / Iraq / Syria / Afghanistan 
Missing in Action (MIA) 

Events of military history (WWII and Vietnam) 

PTSD / Suicide 

Pro-Muslim / Pro-refugee 

Anti-Islam 

Christianity / Jesus / Bible 

Al-Qaeda [variation in spelling] / Osama Bin Laden 
Domestic terrorism / School shootings 

Secretary Hillary Clinton / Benghazi 

Senator Bernie Sanders 

President Barack Obama 

Candidate Donald Trump / President Donald Trump / “Make 
America Great Again” (MAGA) 

Support Our Troops / Respect Our Troops / Troops Killed in 
Action (KIA) 

Healthcare / Patient protection and Affordable Care Act 
Education 

Economy / Debt / Evictions / Unemployment / 
Homelessness 

Anti-immigration / Anti-Refugees 

Deportation of veterans by Immigration and Customs 
Enforcement (ICE) 

Drugs / Gangs 

Military families 

Service animals / Wounded veterans 

Cessation / Separatists / State pride 

“Green Light” bill 

Toxic exposures (tainted water at Camp Lejeune) 
Disposable veterans / Government lack of care for vets 
VA failure / Wait times 





Ad ID 1840 


Ad Text Killary Clinton will never understand what it feels like to lose the person you 
love for the sake of your country. Honoring the high cost paid by so many 


families to protect our freedom. Buy a T-shirt - help a veteran: Veterans USA 


Funnylnst 
Ad Landing Page https://Awww.instagram.com/veterans_us/ 


Ad Targeting Location: United States 
Age: 18 - 65+ 
Language: English (US) 


Placements: Instagram Feed 


People Who Match: Interests: Iraq and Afghanistan Veterans of America, 
Vietnam Veterans of America Foundation, Veterans For America, Support our 
troops, US Military Veterans, Vietnam Veterans of America, Support Our 
Veterans, Concerned Veterans for America or Supporting Our Veterans 


Ad Impressions 17,654 
Ad Clicks 517 
Ad Spend 3,083.95 RUB 
Ad Creation Date 08/17/16 12:14:05 AM PDT 





Figure 133: This is the data provided by HPSCI to describe the Russian IRA ad #1840, which is shown in Figure 134 and 
specifically targeted IAVA, Vietnam Veterans of America Foundation, VVA, and CVA. This ad was selling MilVet-related 
merchandise, funding the IRA, and possibly scraping financial and other sensitive information from MilVets. 
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dog. Support our Veterans - Follow! 


what it feels like to lose the person you love for the 
sake of your country. Honoring the high cost 





Figure 134: This is what Instagram users who follow IAVA, Figure 135: Captain Luis Carlos Montalvan and his service 
VVA, CVA, etc., saw in their feeds when being fed Russian dog, Tuesday. 
IRA ad #1840. 
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(text continued from page 108) 


The HPSCI staff identified several categories 
of ads according to subject matter ina 
November 1, 2017, memo, including: Black 
Lives Matter, Race issues, Immigration, 
Islam/Sharia law, Hillary Clinton, Bernie 
Sanders, LGBT issues, and more.!” 


The unclassified January 2017 Intelligence 
Community Assessment (ICA) states that the 
purpose of using divisive material by the IRA 
was to cause discord.!“ The MilVet-focused 
ads often centered on these issues and can be 
further refined under the subcategories (ads 
can fit multiple categories based on imagery 
and associated text) listed on the chart on 
page 111.!” 


Russians Selling MilVet Merchandise 


Some of these ads exhibited behavior that is 
similar to most of the foreign-born social- 
media accounts, pages, and groups that VVA 
has been tracking in this investigation. For 
example, these Russian ads linked to third- 
party websites that sold MilVet-themed 
merchandise — which we've found most of 
the MilVet-focused pages that have foreign 
admins are currently doing. Because the 
URLs for the third-party websites were 
redacted from the ads released by HPSCI, we 
cannot confirm whether the foreign entities 
we ve been evaluating are using the same 
third-party websites as the Russians. Who 
profits from sales of MilVet merchandise in 
any of these cases is also unknown. 


Ad #1840 (Figures 1383 and 134) is one 
example of a Russian ad that encouraged 
Instagram users to buy merchandise, 
purporting that doing so would help 
veterans. 


The ad was targeted at a variety of 

types of veterans organizations: the 
congressionally chartered VVA; the now- 
defunct international humanitarian 
organization Vietnam Veterans of America 
Foundation; the mostly online 501c8 veterans 
organization IAVA; and the Koch-backed, 
conservative 501c4 veterans activism group, 
CVA. 


The Russians paid 8,083.95 rubles to 
purchase this ad ($49.34 US on the date of 
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the ad buy,!” according to Google’s online 
currency converter tool). For less than 

$50 this single ad was put into the feeds 

of Instagram users who met the specific 
targeting criteria of following the above 
veterans organizations — speaking English!” 
and of age 18 or older — 17,654 times and was 
clicked-on by Instagram users 517 times. 


Captain Luis Carlos Montalvan 


Audience-building content included a 
photograph of the late-author-and-disabled- 
veteran-advocate Captain Louis Carlos 
Montalvan. In the photo, Mr. Montalvan is 
sitting down, wearing his Army dress-blues 
uniform and holding a cane while kissing 
and cuddling with his service dog, Tuesday 
(Figure 1385). Mr. Montalvan was the author 
of the 2011 book Until Tuesday: A Wounded 
Warrior and the Golden Retriever Who Saved 
Him and was working with Congress to 
ensure that the VA engaged in thorough 
research on the impact service dogs have on 
veterans with PTSD. Mr. Montalvan was a 
personal friend of the author of this report, 
as he was for many of the advocates who 
work in DC on MilVets policy. He died of 
suicide in December 2016,' but his photo 
will forever remain as evidence of a crime 
against the United States, since Russian 
propaganda networks used it for several paid 
ads.//? 


Indications of What MilVets 
Running for Office in 2020 
Should Expect From Russia 


The Russians have already targeted a MilVet 
who is currently running for the Democratic 
nomination for the 2020 presidential 
campaign, though it was in an ad paid for in 
June 2015. Russian Ad #657 features a cartoon 
of Mayor Pete Buttigieg, depicted in his 
Army uniform, and in front of a waving gay- 
pride flag (Figure 186). The ad advertised the 
Russian-controlled Facebook page “LGBT 
United,’ and highlighted Mr. Buttigieg’s 
coming out as gay, as well as his military 
service (Figure 187). 
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Although this ad appears to be supportive 


of Mr. Buttigieg and LGBT individuals, the E LGBT United i Um Page 
purpose of the ad-buy was to expand the Bpeneceed« @ 
audience for aq p age that was otherwis e meant Pete Buttigieg is South Bend's 32nd mayor and America's youngest mayor 
j . . of a city of over 100,000 residents. 
to create and amplify social conflict among Recently Buttigieg came out publicly as gay. In life and in service, people like 


Pete is an inspiration for us all! 
#igbt #QueerQuote #USpolitics #indiana #ComingOut #Buttigieg 


Americans. The quote within the meme 

that is attributed to the mayor is used in 

this context to subconsciously elicit in the 
mind of LGBT Americans the painful history 
of being forced to remain closeted and 
unaccepted by friends, family, and American 
society. Mr. Buttigieg’s military service and 
sexual orientation will continue to be used 
by Russians seeking to divide Americans as 
he becomes an ever-more popular figure at 
least throughout the remainder of, and likely 
beyond, the Democratic primaries for the 
2020 presidential race. 


id pec cir gel pbk | 
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i Like @ Comment @ Share 





Figure 136: Mayor Buttigieg has been on the radar of 
Russian intelligence since at least June 2015 as someone 
whose personal story and identity could be exploited to 
divide Americans along political lines. 


Ad ID 65/7 


Ad Text Pete Buttigieg is South Bend's 32nd mayor and America's youngest mayor of 
a city of over 100,000 residents. 
Recently Buttigieg came out publicly as gay. In life and in service, people like 
Pete is an inspiration for us all! 


#igbt #QueerQuote #USpolitics #Ilndiana #ComingOut #Buttigieg 
Ad Landing Page httos:/Mwww.facebook.com/LGBT-United-839497472793277/ 


Ad Targeting Location - Living In: United States 
Age: 18 - 65+ 


Placements: News Feed on desktop computers or News Feed on mobile 
devices 

People Who Match: People who like LGBT United, Friends of connections: 
Friends of people who are connected to LGBT United 


Ad Impressions 30 
Ad Clicks 1 
Ad Spend 9.15 RUB 
Ad Creation Date 06/23/15 07:04:39 AM PDT 
Ad End Date 06/24/15 07:04:39 AM PDT 





Figure 137: The spending, ad impressions, and ad clicks on this particular ad featuring Pete Buttigeig are very low — the 
HPSCI has not released information to the public regarding organic content; it’s unclear how many clicks, impressions, 
etc., were garnered with this same exact content in social-media posts that werent boosted as ads. 
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Chapter 6: Identity Theft of MilVets to 
Engage in Financial Fraud and Espionage 


The names and photos of MilVets — both 
living and deceased — are often used by 
foreign entities to create imitation accounts. 
There are two primary nefarious uses for 
these fake accounts: to engage in financial 
fraud that targets Americans both inside 
and outside the MilVet community; and 

to infiltrate the national security and 
intelligence communities in order to recruit 
Americans to commit espionage. 


The Yahoo Boys 


It is common for these falsified accounts to 
purport to be representing individuals in 
desperate situations: deployed, widowed, 
separated from their children, and in dire 
need of financial assistance to get home to 
the US. The most notorious romance scams 
originate from Nigeria and other West 
African countries,!8° where due to economic 
conditions, it is relatively common for young 
men to engage in cybercrime.'*! 


These cybercriminals proudly call 
themselves “Yahoo Boys,’ a nickname 
earned from the early days of the internet 
when Yahoo! email addresses were used to 
facilitate financial scams. Yahoo Boys steal 
the identities of servicemembers because 
those identities help to explain otherwise- 
suspicious connectivity issues, timing of 
messages, and delayed responses when 
the scammers interact with their victims. 
Servicemembers are also targeted for 
identity theft because the scammers are 
able to take advantage of the patriotism of 
Americans and a desire to take care of those 
who serve our country. 


Yahoo Boys frequently troll the comment 
sections of Facebook groups and other 

online forums that are dedicated to 
supporting widowers and widows.'®? The 
scammers, using the identities of American 
servicemembers, leave comments on posts of 
people who share their stories of the loss of 

a loved one. The scammers pretend they are 
sympathetic, posting (insincere) kind words 
to the heartbroken widowers and widows and 
taking advantage of their vulnerable state by 
building relationships with them at their time 
of greatest need. The Yahoo Boys frequently 


target older Americans who may not be very 
familiar with the internet and are therefore 
more susceptible to online scams.!** 


This problem is not limited to Facebook. 
Yahoo Boys also use Instagram, Twitter, 
WhatsApp, and other social-media platforms 
and messaging apps to assume the identities 
of American servicemembers and veterans to 
target Americans with financial scams. 


A recent investigation by the New York Times 
revealed that scores of fake profiles were 
flagged and reported to the attention of 
Facebook and Instagram for imitating the 
Department of Defense’s top leaders; yet 
the majority of the reports either resulted 
in responses saying that the profiles didn’t 
violate the companies’ terms — or the 
reports went completely unanswered.'** 


This has been the experience of Kathy 
Waters, one of the founders of a group called 
Advocating Against Romance Scams. Ms. 
Waters told us that she first became aware of 
this scam when an elderly friend was targeted 
by a scammer purporting to be Colonel 
Bryan Denny (Ret). Ms. Waters later found 
dozens of fake profiles using variations of 
Col. Denny’s name and his photos. Since 
2017 the group has advocated for the federal 
government to take action against the Yahoo 
Boys, with little to no success. The New York 
Times found that the “F.B.I. said it received 
nearly 18,500 complaints from victims 
of romance or similar internet scams last 
year, with reported losses exceeding $362 
million.”!®5 

(text continued on page 118) 
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Figure 138: Quote from Yahoo Boys filming a video chat with an elderly victim after they scammed him: “You like nudes? 
You cry now, cry!” 





Figure 139: Quote from senior victim: “Goddammit please give me my money back. | dont have money like this. My mom 
wont even talk to me ‘cuz of this.” 
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Figure 140; “Dont lie to me! 1 bought you a card this morning. That's not fair! | don’t understand!” an elderly woman cries 


when a Yahoo Boy reveals the scam and teases her. 


(text continued from page 116) 


According to Ms. Waters, the FBI won't 
prioritize these types of financial scams 
because they’re less than $1,000,000 per 
occurrence — despite the fact that these scams 
have cost many Americans their entire 
retirement savings. 


Although Yahoo Boys generally hide their 
identities, some of these impostors have 
publicly boasted about their crimes, even 
posting videos on YouTube and Instagram 

of them teasing elderly victims as these 
seniors cry and beg for their life savings to be 
returned (Figures 188-140).!86187 


The effects of the financial crimes are both 
financially and emotionally devastating. 
After learning that the “soldier” whom she 
had given her life savings to was actually 

a scammer, Renee Holland (the primary 
subject of the New York Times’ report) 
attempted suicide. She died while the 
reporter was still working on the story — asa 


result of a double-murder-suicide committed 
by her husband.!*® 





The effects on the MilVets who are victims 
of the identity thefts and financial crimes, 

as well as the effects on their families, 

are loathsome in many ways. Victims 

who have fallen for the identity theft of 
servicemembers and veterans may approach 
families to inform them that photos of 

their deceased loved ones were used by 

the Yahoo Boys to commit fraud, and this 
knowledge is a constant, painful reminder 

of the loss suffered by surviving families 

and retraumatizes them. MilVets who have 
their identities frequently used in romance 
scams often give up their use of social-media 
altogether — which eliminates useful, healing 
tools to remain connected with the people 
with whom they served. 


Chinese Espionage 


“Deepfake” technology is developing at a 
rapid pace, both for legitimate commercial 
reasons and to engage in fraudulent activity. 
Deepfakes can be used to create comical 
video clips that friends send to one another, 
in the same way that goofy Snapchat and 


Instagram filters make a user appear as 

a sparkling fairy or with virtual cat ears 

that follow and respond to the user’s facial 
expressions and head movements. They can 
also be used to create hyper-realistic internet 
personas with the goal of committing 
espionage. 


Tech-savvy developers focused on realism 
are producing apps that can quickly churn 
out falsified images, audio, and videos that 
are so convincing they're difficult for both 
people and computers to detect. Hostile 
Chinese intelligence services, according to 
reporting by the Associated Press, have been 
using computer-generated deepfake images 
to create phantom profiles of people (who 
do not exist) that portray them as members 
of the American defense and intelligence 
communities, while displaying their social- 
media connections to build credibility (real 
people routinely accept all invitations to add 
to their social network) — primarily on the 
professional networking site LinkedIn.'*? 
Chinese agents catfish (lure someone in 

to arelationship by using a fake persona) 
government officials and employees, offering 
cash for information and recruitment.!*° 


Spotting Fakes and the Imitation of Army 
Staff Sergeant Sherri Viastuin 


Finding these types of scam profiles can 

be as easy as doing a search for a veteran, 
particularly those who are public figures 

or social-media influencers. Staff Sergeant 
Sherri Vlastuin, an Army medic"! and 
Instagram influencer,’*? is the victim of 
identity theft by scores of social-media 
accounts that imitate her on Twitter, 
Instagram, Facebook, and LinkedIn (Figures 
141-143). One LinkedIn profile falsely 
identifies Ms. Vlastuin as being afhliated with 
Army Intelligence,'*? which may indicate that 
her identity is being used to target Americans 
in the intelligence community (Figure 144). 


Staff Sergeant Vlastuin’s real Instagram 
profile (Figure 145) has over 36,500 followers 
and features a warning in her bio that 
references her persistent problem of being 
imitated online: “One & only account 
#SayNoToCatfish."!™ 


As an Instagram influencer with a large 
following, her account is not simply a way 

to provide life updates to her friends, but 
instead it’s a valuable tool she puts effort into 
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to keep relevant and earn income. 


Instagram influencers are among the reasons 
that other users join the social network and 
frequently check the app or website for 
updates. Through selective uploading of 
high-quality content, influencers establish 
their own personal brand, and that brand can 
be used to alter the beliefs, actions, values, 
and commercial activity of other users. 


Unfortunately, Staff Sergeant Vlastuin’s 
content can be easily scraped (a technique 
that extracts data from a website) and reused 
by other internet users for their own brand- 
building or for more-nefarious purposes. 
When she was interviewed by VVA, she said 
that “my mother, my niece, my 

family — they all get used in made-up stories 
for these scams to catfish people.” She went 
on to explain that strangers often reach out 
to her via her official Army email account 

to ask why she was suddenly ignoring them, 
and she has to explain that she had never 
interacted with them before and that they 
were the victims of an online scam. 


Staff Sergeant Vlastuin reported frequently 
contemplating giving up her online presence 
altogether so that her content could no 
longer be used by scammers and so that she 
would no longer have to bear the burden 

of hearing from victims who believed she'd 
been romantically involved with them. 
However, she has said that she feels if she 
were to give up her online presence she'd be 
throwing away her Influencer status and the 
potential earned income of the brand she has 
so carefully cultivated. In the meantime, she 
has given up on proactively trying to have 
her imitation accounts shut down because 
she finds it a frustrating and often fruitless 
endeavor. 


Members of Congress With Military 
Backgrounds Used for Romance Scams 


Victims of identity theft can range from 
young privates in the Army and corporals in 
the Marines to America’s top commanders. 
Veterans who have gone on to become 
politicians are also used in romance scams, 
such as Democrat Patrick J. Murphy and 
Republicans Lee Zeldin and Adam Kinzinger. 


(text continued on page 122) 
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Figure 146: This profile, with a URL indicating that it originally belonged to a person named Albanais Traore but now 
purports to be Patrick Murphy, has Facebook friends who are mostly from West Africa. As is common in many romance 
scams, this profile makes it appear as if Patrick Murphy is currently deployed to Afghanistan. 


(text continued from page 119) 


Members of Congress With Military 
Backgrounds 


Former Congressman Patrick J. Murphy 
(PA-8) 

Patrick J. Murphy’s likeness and name have 
been co-opted on various social-media 
platforms to target vulnerable Americans 
several times. Mr. Murphy, an Army veteran, 
the former congressman for Pennsylvania's 
Eighth Congressional district, and the former 
acting Under Secretary of the US Army, was 
recently contacted by two victims who fell 
for scams using his name and photo. These 
victims have no recourse for their financial 
losses, and it is unlikely that the criminals 
who scammed them will be brought to 
justice without significant policy changes. 


Despite Mr. Murphy's efforts to track down 
and report profiles that use his name and 
photos, there are currently several Facebook 
accounts still purporting to be Mr. Murphy. 
One identifies him as widowed and located 
in Kabul, Afghanistan. This account is based 
in Africa and was originally afhliated with the 
name Albanais Traore’ (Figure 146). Another 
African-based Facebook account purporting 
to be Mr. Murphy was originally affiliated 
with the name Dramani Abass!* (Figure 

147). Another account is based in Burma!%!98 
(Figure 148). A fourth profile, created in 2016, 
does not display enough publicly available 
data to determine its origin’? (Figure 149). 
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Congressman Lee Zeldin (NY-1) 

The likeness of Congressman Lee Zeldin, 
an Army veteran and representative for 
New York’s First Congressional District, is 
being co-opted on Instagram to engage in 
romance scams.?°° Some of these photos 
include pictures of Zeldin posing with his 
twin daughters — but not his wife — to give 
potential victims the impression that Zeldin 
is a widower or divorced (Figures 150-152). 
The Instagram bio using Mr. Zeldin’s photos 
says only, “Give Me Love.” The Instagram 
account posts ameme saying “ONLY JESUS 
CHRIST CAN SAVE YOU,’ but Mr. Zeldin 

is Jewish. References to religion, especially 


Christianity, are common in romance scams. 
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Congressman Adam Kinzinger (IL-7) 
Congressman Adam Kinzinger, the 
representative for Illinois’s Sixteenth 
Congressional District, serves in the Air 
National Guard as a lieutenant colonel 

and has confronted Facebook CEO Mark 
Zuckerberg directly about his persistent 
problem of being imitated online.?°! Mr. 
Kinzinger wrote a letter to Facebook on July 
31, 2019, to address this issue.?° In the letter, 
Kinzinger notes that he has been the victim 
of online imitation for over a decade. He also 
writes about his congressional staff having to 
spend much of their valuable time tracking 
down these fake accounts in order to stop 
them from engaging in romance scams and 
other forms of financial fraud. Kinzinger has 
been in touch with victims who have lost tens 
of thousands of dollars to scammers who 
have used his name and likeness. 
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Figures 150-152: The troll who operates this Instagram account is using Congressman Lee Zeldin’s children 
as bait fora romance scam. We have censored their faces as they are minors. 
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CHAPTER 7: Facebook’s Switch 


to “Groups” and the Dangers of 
“Community” and “Privacy” Focus 


In light of the increased pressure on 
Facebook to maintain users’ privacy and 
slow the spread of 2016-style disinformation 
campaigns, CEO Mark Zuckerberg 
announced that the company will shift away 
from pages and instead focus on groups. 
The intent is to “shift Facebook away from 
being a public town square and to private 
communications. ?°? While some users and 
policymakers may appreciate the shift, 

the foreign admins who target troops have 
already adapted to get ahead of Facebook's 
redesign. 


Facebook pages were designed so that 
companies, public officials, and groups 
could communicate more easily with their 
customers, constituents, or members — 
while being able to control and project 
their brand’s image. Pages are different 
from “profiles,’ which are meant to be 
personal.?™ A person’s Facebook profile is 
the core of their user experience — it’s what 
they use to upload photos, create albums, 
send and accept friend requests, and post 
updates about their lives so that they can 
remain connected with friends and family 
across the globe. Pages, on the other hand, 
are akin to a digital storefront, complete 
with online stores and customer-service 
messaging. Facebook pages can be viewed 
by any Facebook user (unless they are 
individually banned or blocked), whereas 
Facebook profiles can be set with restrictive 
privacy settings according to the preference 
of the individual. Facebook users can leave 
comments on most status updates, photos, 
and links posted by pages — and leave 
detailed reviews for the page and the brand 
it represents. Facebook users can also share 
anything posted by pages onto their own 
timeline, so that the individual users’ friends 
and followers can see them. 


Pages don't necessarily have to represent a 
real-world entity. Pages can also be parodies 
or unofhcial fan clubs, or a tool to aggregate 
and disseminate information and news about 
any particular topic of interest. 


Any Facebook user can create and be an 
administrator (aka admin) for a page and can 
authorize and assign other Facebook users 
administrator privileges to help manage the 


page. 


I, the author of this report, have my own 
personal Facebook account. I use this 
account to post everyday updates about 

my life and photos from both work and my 
personal life, to share news and information 
that I find important, and to assist VVA’s 
communications team with the management 
of VVA’s official Facebook page. With the 
administrator privileges granted to my 
personal account by VVA, I can schedule 
posts to be displayed at a particular time 
and date, put up photos, stream live video, 
communicate with users who send messages 
to the page, and moderate comments on 
any of VVA’s public posts. I can also see 

how our audience, the people who follow 
our Facebook page, are reacting to and 
engaging with the things that we post. I can 
schedule real-world or virtual events, and 
set “premieres to encourage our followers 
to view new video content together. I can 
choose to reveal my personal account on 
VVA’s page as an admin, or I can hide it and 
have only my country of origin revealed 

on the page. These administrator privileges 
can be given, limited, and taken away by the 
“owner of the VVA Facebook page, which 

is VVA’s communications director (via their 
personal Facebook account). 


VVA uses our Facebook page as one of our 
primary tools in informing our members of 
the work that the organization is doing on 

a day-to-day basis, of events that they can 
participate in, and of the priorities of the 
organization. Our Facebook page is a force 
for good. 


However — the brand-building, 
dissemination of information, event 
scheduling, and audience-monitoring tools 
that Facebook pages provide can also be used 
for nefarious purposes, as they were by the 
Russian IRA. 

(text continued on page 129) 
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Figure 153: “The patriots walk” featured MilVet and law-enforcement memes with distinctive green and yellow meme text 
that is frequently seen on other pages with foreign admins. 
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Figure 154: “The patriots walk” Facebook page is connected to a Facebook group called ‘American Pride,” which 
specifically targets severely disabled veterans who have disability ratings of 100 percent from the VA. 
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Figure 155: The ‘About’ tab of the ‘American Pride” Facebook page contained subtle hints of an admin who was a 
non-native English speaker. 
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Figure 156: The ‘American Pride” and “The patriots walk” pages posted content from the same source, as revealed by 
the common yellow, green, and orange meme text. 
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(text continued from page 126) 


Over the course of our investigation, VVA 
has found scores of veteran-focused pages 
operating in a manner that is similar to that 
of the IRA, though admins are controlling 
these pages from dozens of countries. 


Since November 2017 Facebook's Threat 
Intelligence Team has, to their credit, 
removed every veteran-focused page with 
foreign admins that we have specifically 
flagged for them. We have flagged pages that 
were specifically imitating VVA, as well as 
pages that were spreading dangerous 
rhetoric — though we have opted not to 
report the majority of the pages that we're 
following. This is so that we can continue 

to gather evidence in the hope that law 
enforcement will step in and interdict the 
individuals — the criminals — who are 
seeking to exploit servicemembers and 
veterans and engage in election interference. 


To simply request that Facebook close 
fraudulent pages when they are reported 
does little to disincentivize the activity of the 
people behind the screens. Though it may 
frustrate the admins temporarily, they've got 
everything they need to simply rebrand and 
create a new page that does exactly the same 
thing. 


Facebook groups have been a useful tool 

for these foreign admins to maintain their 
audience of American veterans in the event 
their page is taken down and their personal 
account is banned. Facebook groups are 
similar to pages in that they are “owned” and 
moderated by a controlled set of admins, but 
they're designed in a way that usually allows 
any member to project their voice by posting 
to all other members of the group. Admins 
can relax settings so that it’s a free-for-all, 

or they can tightly control the group so that 
posts by members need to be approved 
before being revealed to the entire group. As 
they can with a page, group admins are able 
to set the tone of the conversation within 

a group, as well as censor or hide whatever 
content or comments don't serve their 
purpose. 


There are three different group types: 
public, closed, and secret,?°?°° and admins 
can control privacy settings for the group to 
the various levels — which presents specific 
challenges to independent investigators who 
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are not associated with the Facebook pages. 


Public groups can be seen by 

anyone — including people who are not 
logged onto Facebook accounts (for example, 
they may come across the group as a result 
of a Google search, or a friend sent them a 
link to the group). People who are logged 
onto Facebook can request to join a group 
via their personal profile or as a page that 
they manage, which the moderators can 
approve or deny. While investigators don't 
have to join a public group to monitor it, 
investigators will lose the ability to monitor 
it if the group type and privacy settings are 
changed by its admins. 


The names and group descriptions of closed 
groups can be seen by anyone, but the list 
of members is hidden to non-members. 
Posts within the group are also hidden unless 
membership is approved by an admin. 
These request-to-join and admin-approval 
requirements to see what is posted in closed 
groups presents a level of obscurity that is 
not a problem for investigators monitoring 
Facebook pages (as it is when trying to 
monitor groups). 


Secret groups are completely hidden and 
will not appear even in search results on 
Facebook for non-members of the group. 
They are invite-only, so admins tightly 
control not only the conversation within the 
group but also who can see that the group 
even exists. 


Group privacy settings can also be set 

so that members cannot use the typical 
“share” button to distribute the content 
that is posted within the group to places on 
Facebook outside of that group. Members 
can, however, copy and paste text and links, 
as well as screen-capture or download and 
repost images. This barrier to sharing helps 
to bury the trail to the original source of the 
content because when individual users post 
it, it looks like organic content belonging to 
their individual account. 


Groups can now be afhliated with 

Facebook pages so that they appear in the 
“Community” tab of the page. In addition to 
individual Facebook accounts being used to 
moderate these groups, admins can use the 
page itself to act as an administrator within 
the group. 
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During our investigation we discovered that 
foreign admins sometimes recruit “useful 
idiots’ to serve as backup administrators 
for both their pages and groups. This makes 
it so that if the foreign admin's personal 
account and/or page is banned by Facebook, 
the admin can simply create a new account 
and recover its following by being granted 
administrator privileges by the useful idiot. 
Allegations that Facebook is suppressing 
dissenting voices?” has primed some 
Americans who are serving as useful idiots 
(and unknowingly aiding foreign admins) 

to believe that foreign admins who are 
banned for things like fraudulent behavior 
or election interference are instead victims 
of censorship — rather than foreign agents 
seeking to disrupt our democracy and prey 
on innocent Americans. Once the foreign 
admins resume control of the group, they 
can create a new page that features the very 
same content previously posted — and 
because they are already familiar with the 
self-selected group members, the admins 
can quickly rebuild a page with a massive 
following.?° 
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The Evolution of a Backup 
Group: “American Pride” 
Becomes “SHARED” Becomes 
“Animals Worldwide” 


On April 80, 2018, a Facebook page called 
“American Pride” was created, and on July 
5, 2018, a Facebook page called “Patriots 
Walk” was created. Both of these pages built 
audiences using the same content — which 
was easily recognizable by the frequent 
memes with veterans in uniform and bright 
orange-green-and-yellow meme-text 
overlays (Figures 158-158). 


By the time we found these pages on July 17, 
2018, “American Pride” had 116,318 followers, 
while “Patriots Walk” had far fewer, with only 
141 followers. Together, these pages acted 
as administrators for the Facebook group 
also using the name American Pride, which 
had 155 members within one week of its 
creation (Figures 159 and 160). The group's 
description specifically targeted disabled 
veterans, reading: “This group is open to 
all veterans working on claims or who have 
reached 100% who would like to offer help to 
fellow vets still dealing with open claims and 
appeals” (Figure 161). 

(text continued on page 134) 
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Figure 158 
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Figure 159: The ‘American Pride” Facebook page is connected to the same group as the Facebook page “The patriots 
walk,” which indicates that both pages are controlled by the same admins. 
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Figure 167: Here you can see that the admins of the ‘American Pride” Facebook group were misleading veterans into 


believing that its purpose was to assist with VA disability claims. 
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Figure 162: Here, Astrit Aliu, an admin from Kosovo, is recruiting a “useful idiot” to help reduce the workload in 


maintaining the Facebook group. 
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Figure 163: The Kosovar admin Astrit Aliu posts a meme featuring an injured police officer with weapon drawn into the 
‘American Pride” group. The comment is meant both to provoke outrage and to provide an outlet for that outrage: asking 
users to comment and share to show their support for police officers. 


(text continued from page 180) 


The admins for the group, who remain 
admins today, are based in Kosovo. 


On August 8, 2018, one of the Kosovar 
admins, “Astrit Aliu,’ started recruiting useful 
idiots — Americans who could help them 
manage the group and make it appear to be 
authentic (Figure 162). 


On August 29, 2018, Astrit Aliu started 
soliciting photos of veterans in uniform 
under the guise of connecting old friends. 
Veterans started volunteering their photos 
and information about their service in droves 
(Figures 164-170). This was both a ploy for 
engagement, which would boost the post into 
people’s news feeds, and also to extract from 
veterans new photographs that could later be 


used as the basis of new content for the 
foreign admins. 


Astrit Aliu frequently shared divisive content 
in the group, such as memes featuring 
bleeding servicemembers or police, along 
with comments scripted to provoke outrage 
(Figure 163). And with the outrageous 
content, the group’s membership swelled, 
attracting hundreds of MilVets and members 
of the law-enforcement community. 


At some point in late 2018 or early 2019, 
both the “American Pride” and “Patriot Walk” 
pages were removed by 

Facebook — as Facebook recognized the 
problem of coordinated inauthentic activity 
originating in Kosovo — but the backup 
group remained. 
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Figures 164-170: American veterans 
unknowingly share their military 
history and photos with foreign 
admins after being prompted to 
share this information by a foreign 
admin under the guise of a mission 
to connect long-lost battle buddies. 
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Group History shows when this group was created, as well as changes 
to its name. You can use Group History to see whether a group's 


purpose has changed over time. 


\2 The group American Pride was created 


Jul 8, 2018 


(4 Changed name to Animals Worldwide 


May 4, 2019 


Changed name to SHARED 
Dec 29, 2018 





Figure 173: Facebook now provides “Group History,” which displays information regarding the name changes 


of the group. 


(text continued from page 184) 


On December 29, 2018, the group was 
renamed SHARED and made a drastic 

shift from posting pictures of Americans in 
uniform to exclusively cheery, inspirational- 
poster-styled memes (Figures 171-178). 


The group name changed again on May 4, 
2019, to Animals Worldwide, which shares 
pictures of animals and related content 

to draw in followers. Despite the shift in 
content, the group description targeting 
disabled veterans remains the same and 
has since grown in membership to 15,991 
Facebook users. 


“Veterans Nation” and 
“Veterans Nation — Honoring 
All Who Served” 


The page “Veterans Nation” was created on 
September 9, 2014, and currently has 206,442 
likes.?°° The affiliated Veterans Nation — 
Honoring All Who Served closed group?!® 
was created on June 26, 2018, and has 11,893 
members — all of whom had to request to 
join (including this investigator). 


On January 4, 2015, the page admin posted 
a logo stolen from “We Honor Veterans” as 
the profile photo, which is currently the first 
photo visible on the page (Figure 174). 


Admins for the Veterans Nation — Honoring 
All Who Served group included the 
“Veterans Nation” page, an admin going by 
the alias “Kim Johny” (this user account was 
deleted), and one remaining admin using 
the alias “Kelvin Henry,’ who based on other 
activity on Facebook appears to be located 
in Vietnam and dedicated to targeting 
American veterans. The Kelvin Henry 
account was created on November 22, 2014, 
using a stock photo of a blond woman. The 
account posts brief status updates in English 
with grammatical mistakes typical of a non- 
native English speaker. It references the 
Women’s March in early 2017, then appears 
to adopt the identity of a male American 
veteran on June 25, 2018. 


The “Veterans Nation” entity has a complete 
online ecosystem: a Facebook page and 
group, a website,”" a Twitter account, and an 
Instagram account. The website is selling the 
same type of merchandise as the confirmed 
Russian websites that are described and 


(text continued on page 141) 
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~ Veterans Nation 


OO 15 1 Comment 8 Shares 
d) Like C) Comment (> Share a. 

Most Relevant + 

& EE |t's about time. 


Like - Reply - 3y 
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WE HONOR VETERA 





Figure 174: The Facebook page “Veterans Nation” uploaded the logo of the legitimate organization “We Honor Veterans” 
as a profile photo in order to gain credibility among MilVets. 
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Figure 1/5: The Facebook page “Veterans Nation’ is affiliated with the website Veteran Nations [sic], which sells 
merchandise similar to that which was sold by sites affiliated with the Russian IRA. 


138 


CHAPTER SEVEN 


Veterans Nation 
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Figure 1/6: The Facebook page “lea Party News” was identified as a Russian IRA disinformation outlet, yet its content 
lives on in pages with foreign admins such as “Veterans Nation.” 
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Figure 177: “Being Patriotic” was a brand created by the Russian IRA. 
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Figure 178: This is a Russian IRA “Being Patriotic” meme that was cropped to remove the easily recognizable golden 
scroll and logo. 
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Figure 179: Russian IRA content can often be identified by signature traits, such as the golden text in this “Being Patriotic” 
meme. This post also advertises the page admins’ affiliated Instagram account, while using a link-shortener to mask the 
WRKL, 
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IGHLIGHTS 
Hits eh! nl 


~ Veterans Nation 
ij =O Admin - August 22, 2018 
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ee ER ool Ee Ds 
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39 Comments 
t) Like (_) Comment 


View 20 more comments 


Figure 180: August 22, 2018, admin tags and welcomes dozens of veterans to the group as a way of kicking off user 


engagement. 


(text continued from page 137) 


as “Tea Party News”?3?* and “Being 
Patriotic” (Figures 176-179).2!.216217 


displayed on page 31 of the report “The 

Tactics & Tropes of the Internet Research One enhanced element of the “Veterans 
Agency by New Knowledge (Figure 175). Itis | Nation” entity is its engagement with 
unclear whether there is a nexus between the members within the group that it controls. 
Veterans Nation entity and the IRA. However, At times it creates “welcome” posts, tagging 


New Knowledge warns that “merchandise dozens of new group members, which 
perhaps provided the IRA with a source of triggers lots of comments and reactions — 
revenue, as well as offered a way to scrape taking advantage of Facebook’s algorithms 
personal and financial information from and expanding the group’s reach (Figure 180). 


victims.?!2 


Whether the purpose of “Veterans Nation” is 
only to sell merchandise is unknown — but 
the practical effect of the divisive content 
that it shares may be the same as the IRA. 
The Facebook page posts recycled, confirmed 
Russian IRA-generated memes from entities 
listed in the Mueller report such 
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CHAPTER 8: First-Known 2020-Election 
Interference — Macedonians Steal and 
Promote “Vets for Trump,” Facebook Fails 
to Respond to American Admins’ Pleas for 


Help 


At the point a Facebook page reaches an 
audience of a certain size or when it begins to 
purchase political ads, the countries of origin 
of the page’s admins are revealed in the “Page 
Transparency’ tab. However, despite recent 
reforms by the company to make the Page 
Transparency tab more accessible, relatively 
few Facebook members use it to check on a 
page’s point of origin or whether the political 
content they interact with is being provided 
by Americans. While the Page Transparency 
tab lists the history of a page’s name changes, 
which may include clues of inauthentic 
behavior, as well as the admins’ countries of 
origins, it does not include the history of the 
admins’ countries of origins — the trail of 
which could also offer clues of inauthentic 
behavior. The lack of user-friendliness of 

the Page Transparency tab and ironically, 

its lack of total transparency, takes away 
from its usefulness and purpose as a tool for 
Americans to easily discover whether the 
content is posted by provocateurs with the 
intent to confuse, trick, and manipulate. This 
helps explain why the “Vets for Trump? 
Facebook page — which according to the 

tab had three admins in Macedonia and 

one admin in the United Kingdom but 

none in the US from at least April-August 
2019 (Figure 181) — had a rapidly growing 
audience (from around 120,000 to 181,000 
followers) while it was hijacked by foreign 
entities. 


Followers of this page while it was under 
Macedonian/UK control includes at least one 
elected official?!” who was a Trump campaign 
surrogate (Figure 182),??° in addition to an 
individual who was the director of Military 
& Veterans Outreach for the Republican 
National Committee (GOPVets).?”! If 
Facebook users who were involved in and 

so Closely affliated with the 2016 Trump 
campaign did not recognize that the “Vets for 
Trump” Facebook page was run by foreign 
admins — it’s unlikely that the common 
Facebook user who is far less familiar with 


the Trump campaign and its afhliates would 
recognize this type of inauthentic behavior. 
In fact, while Macedonians controlled the 
page it experienced a notable spike in growth 
and engagement from its audience. 


Macedonia is known to be a hotbed 

for fake-news websites and plagiarized 
misinformation that targets Americans 

with divisive political content.??? Mirko 
Ceselkoski, a Macedonian self-proclaimed 
“internet professor, teaches young people 
how to create viral content, which he claims 
“helped Donald Trump win US elections.’2”3 
An investigation by BuzzFeed News, the 
Organized Crime and Corruption Reporting 
Project, and the news outlet Investigative 
Reporting Lab Macedonia revealed that the 
Macedonian fake-news industry was created 
by a Macedonian media attorney, Trajche 
Arsov, along with his brother Panche Arsov, 
who “worked closely with two 

high-profile American partners for at least six 
months during a period that overlapped with 
Election Day” in 2016.74 


The BuzzFeed article notes that Panche 
Arsov goes by the nickname “Pane,” while 
Trajche goes by “Tale.” The email address 
listed under the contact information 

for the “Vets for Trump” Facebook page 
during the time it was under Macedonian 
control includes both Panche’s last name 
and nickname: arsovpanelO@gmail.com 
(Figure 183). We reached out to that email 
address, and the responses came from a 
Gmail account self-identifying the user as 
“Pane Arsov.’ This Gmail user responded 

to our inquiries, claiming to own the “Vets 
for Trump” Facebook page and to have 
purchased it from a previous owner, “Loliot 
Germans 2” and the business “AD BREAK” 
in April 2019. We could not independently 
verify that the Gmail user is indeed the Pane 
AYrsov 


(text continued on page 145) 
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Page Transparency for Vets for Trump 


Summary Page History People Who Manage This Page 


Page Transparency Summary 
Facebook is showing information to help you better understand the purpose of a Page. 
See actions taken by the people who manage and post content. Learn More 


Page History People Who Manage This Page 


o Page created December 16, 2015 - Vets for ©) Primary country location of people who 
Trump manage this Page includes: 


Macedonia (3) 


(F Page changed its name 3 times. 
United Kingdom (1) 


s»° Merged with 0 other Pages. 


See More 


Ads From This Page 
This Page is not currently running ads. 


Go to Ad Library 


Give feedback or report this Page 





Figure 181: The Page Transparency tab of the “Vets for Trump” page listed only foreign admins from April through 
mid-August 2079. 


Friends and Vets for Trump 


All3 Likes 


Al Baldasara 
11 mutual friends @ Message 


103 mutual friends © Message 


4 mutual friends @ Message 





Figure 182: “Vets for Trump” followers include Al Baldasaro, a legislator for the state of New Hampshire who served as 
a campaign surrogate for the Trump 2016 campaign, and an individual who was the founder of GOPVets. Both men are 
veterans. Mr. Baldasaro did not respond to requests for comment. 
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Figure 183: “Vets for Trump” Facebook page listed arsovpane10@gmail.com as the sole contact until mid-August 2079. 


Page Transparency for Vets for Trump 
Summary Page History People Who Manage This Page 


Page Transparency Summary 
Facebook is showing information to help you better understand the purpose of a Page. i 
See actions taken by the people who manage and post content. Learn More 


Page History People Who Manage This Page 


sm Page created December 16, 2015 - Vets for ©) Primary country location of people who 
Trump manage this Page includes: 


United States (10) 


(F Page changed its name 3 times. 
Not available (1) 


$>o Merged with 1 other Page. 


See More 


Ads From This Page 


This Page is not currently running ads. 


Go to Ad Library 


Find Support or Report Page 





Figure 184: The Page Transparency tab, as of August 29, 2079, lists 10 admins residing in the US and one listed as “Not 
available.” It is unclear why an admin would be listed as “Not available,” or whether foreign admins have discovered a 
way to hide their true locations from Facebook. 
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(text continued from page 142) 


who was identified in the BuzzFeed 
investigations, though we find the 
circumstantial evidence convincing. 


The Arsovs employed both American and 
British writers to help produce political 
content, which could explain the UK-based 
admin for the “Vets for Trump” Facebook 
page.?*° The BuzzFeed investigation also 
noted that Anna Bogacheva, who had 
traveled to the US to gather 

intelligence — and was one of the 18 Russian 
nationals indicted by Mueller — also traveled 
to Macedonia just before the rise of its 
fake-news industry. BuzzFeed reports that 
Bogacheva’'s entry into Macedonia was not 
recorded — just her departure through 
Greece — which has raised suspicions. 
BuzzFeed was careful to note, however, that 
“reporters found no connections between 
Bogacheva and the Macedonian sites.”??’ 


The “Vets for Trump” Facebook page has 
been coordinating with and closely mirroring 
the similarly named “Veterans for Donald 
Trump” Facebook page?”’ while under 
American control, with the exception of the 
brief period between April and mid-August 
2019, when Macedonians seized control. 

The Page Transparency tab for “Veterans for 
Donald Trump” lists 15 admins in the US and 
none abroad. Both of these pages share the 
same profile photo, though the “Veterans 

for Donald Trump” page posted the photo 

in December 2016??? while the “Vets for 
Trump” page posted it in June 2018.?° 

Both of these pages have been promoting 
the website veteransfordonaldtrump.com 

in their respective background photos, 
including while “Vets for Trump’ was under 
Macedonian control. This Facebook page 
was posting a politically divisive doctored 
image purporting to show an NFL player 
stomping on a burning American flag, and 
was “registered by a man named Vladimir 
Lemets in 2015,’ according to a POLITIFACT 
article about “Vets for Trump.”??! 


The veteransfordonaldtrump.com “About” 
page lists Joshua Macias as the Director 

of Veterans for Donald Trump.??? The bio 
on Mr. Macias’s website says that he is the 
founder of the “Vets for Trump” Facebook 
page, as well as “Chairman of the Veterans 
for Trump Coalition.”?*? Mr. Macias’s bio 
includes hyperlinks to both the “Vets for 


CHAPTER EIGHT 


Trump” and the “Veterans for Donald 
Trump” Facebook pages.?** Mr. Macias 
did not respond to several requests for an 
interview by VVA’s investigator. 


Mr. Lemets is listed as a co-founder and 

the Chief Technology Officer in the “About” 
section of the veteransfordonaldtrump. 

com website. A self-described “Russian-born 
American Nationalist,’22>5 Mr. Lemets is a US 
Army veteran with native fluency in Russian 
and Ukranian. During an interview with VVA, 
Mr. Lemets confirmed his and Mr. Macias’s 
control, past and present, of these pages — as 
well as a Facebook page-admin dispute with 
a woman with the username “Sanja Arsov, 
who claims to be the wife of the person who 
“owned’ the “Vets for Trump’ Facebook page 
from April-August 2019. 


It is this investigator’s opinion that Mr. 
Lemets was honest and candid when VVA 
interviewed him. Mr. Lemets volunteered 

to share documentation that supports his 
claim of foreign theft of the “Vets for Trump” 
Facebook page, as well as his lengthy battle 
with Facebook to resume American control 
of the political page. 


The “Vets for Trump’ and “Veterans for 
Donald Trump” pages have shared exactly 
the same content at the same time (or 
within a minute of one another), which 
normally indicates a common admin and 
supports Mr. Lemets’ claims of ownership. 
The last content that was posted on both 
pages at nearly the same time on the same 
date (before a period of unafhliated content 
was posted while under Macedonian 
control) was on April 3, 2019, with a meme 
featuring General Michael Flynn and 
Jussie Smollett along with the hashtag 
“#IStandWithGenFlynn.”?*°237 


It was around this time, according to 

Mr. Lemets, that Mr. Macias was tricked 
by a company called “AD BREAK” into 
relinquishing ownership of the “Vets for 
Trump” Facebook page, as well as several 
other related pages. 


As we were in the final stages of preparing 
this report, we noticed that identical content 
was again being posted on both pages as of 
August 22, 2019, with cell-phone video of 
President Trump signing an Executive Order 
at the AMVETS National Convention. 

(text continued on page 149) 
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Figure 197 Figure 198: Joe Biden and Bernie Sanders being attacked. 
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Attacks Against Politicians by Macedonians: Elizabeth Warren 
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Figure 206: Biden, Sanders, Harris — including a sexist trope that is accusing Sen. Harris of having “slept her way to the 
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(text continued from page 145) 


The video was posted to the “Veterans for 
Donald Trump” Facebook page at 1:36 AM,??® 
while it was posted to the “Vets for Trump” 
Facebook page one minute later.??° As of 
August 29, 2019, the “Vets for Trump” Page 
Transparency tab now lists 10 admins in the 
US, and one as “Not available” (Figure 184). 
This is consistent with Mr. Macias and Mr. 
Lemets resuming admin privileges of the 


page. 


In a 2018 meeting with Facebook, 
representatives of its Threat Intel Team 

told VVA that page admins cannot spoof 
their country of origin using a Static virtual 
private network (VPN), but the team declined 
to explain how it would be possible for 
Facebook to detect and prevent location 
spoofing. If spoofing is indeed prevented 

on Facebook, it is unclear why an admin's 
location would be listed as “Not available.” 


The “Vets for Trump” page, while under the 
control of only foreign admins, had been 
engaged in election interference: attacking 
Democratic presidential candidates, 
including Joe Biden, Elizabeth Warren, 


Bernie Sanders, Beto O’Rourke, Cory Booker, 
Kirsten Gillibrand, and Kamala Harris — 
though this is consistent with the otherwise 
First-Amendment-protected American-born 
political activity on this page (Figures 185- 
216). Because these attacks were made as 
organic content (without being boosted as 
paid ads), and despite Mr. Lemets’ lengthy 
fight with foreign entities to regain control 
of his purely political page, this election 
interference apparently has raised no red 
flags at Facebook. 


According to evidence provided by Mr. 
Lemets, all of the content posted to the page 
while “Vets for Trump” was under foreign 
control came from a user with the name 
“Bosko Gero’ from Ohrid, Macedonia.?/° 


Mr. Lemets also shared screenshots with VVA 
showing that while the Macedonian users 
were pretending to be “Vets for Trump,’ they 
were taking “donations” via PayPal to support 
their supposed work backing President 
Trump’s 2020 campaign (Figures 217 and 
213)— 


(text continued on page 155) 
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(text continued from page 149) 


The PayPal account that the page’s hijackers 
used for the contributions of “Vets for 
Trump” supporters was actually the account 
for “USA Politics Today,’ an infamous 
Macedonian fake-news site owned by Trajche 
Arsov (Figures 217 and 218).?4? 


Macedonians remain in control of Mr. 
Macias’ Facebook page “Veterans for Trump 
Coalition,’ where they continue to post 
content similar to that which they posted on 
the “Vets for Trump” page. 


Pro-Putin/Pro-Assange/ 
Anti-Comey/Anti-FBI 


The foreign-controlled “Vets for Trump” 
Facebook page also posts content that is 
supportive of Russian President Vladimir 
Putin and WikiLeaks founder Julian 

Assange (Figures 219-222) and hostile to law 
enforcement, especially former FBI Director 
James Comey and the FBI in general (Figures 
223-226). 


Maligning Barack Obama and 
Hillary Clinton and Spreading 
Election Disinformation 


Both President Barack Obama and Secretary 
Hillary Clinton are also targets and 
frequently attacked by the foreign admins 
with baseless conspiracy theories (Figures 
227-230). In addition, voting procedures 

and our election process are often maligned 
(Figure 2381). 


CHAPTER EIGHT 


Fomenting Hate Against 
Democrats of Color and Tying 
Them to 2020 Candidates 


The Vets for Trump page frequently attacks 
members of Congress who are minorities, 
using racist “dog whistles” (or subtly coded 
language), Islamophobic tropes, and 
dehumanizing language to incite division 
among the MilVets community (232-247). 


Alexandria Ocasio-Cortez 

Rep. Alexandria Ocasio-Cortez (AOC) 

is the most frequent target of derisive 
memes,?43744,245,246,247 many related to the 
subjects of immigration™®" and socialism.?”° 
After fueling hatred for Ocasio-Cortez, the 
Macedonians’ posts linked her to democratic 
2020 presidential candidates?*! 

and pitted her against Rep. Dan Crenshaw, a 
Navy veteran.?”” 


Ilhan Omar 

Rep. Ilhan Omar is often targeted,” 
particularly for being a Muslim immigrant,?4 
and the page brands her as antisemitic?” and 
invokes the 9/11 terror attacks.° Omar, along 
with fellow Democrat freshman Ayanna 
Pressley, Rashida Tlaib, and Alexandria 
Ocasio-Cortex are often targeted as a 
sroup.”’ 


Rashida Tlaib 


Posts also link Rep. Tlaib to Senator Bernie 
Sanders?’ and call for her resignation.?°° 
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Figure 247: While this meme was posted by Americans, we chose to include it in this report as an example of 
disinformation that has been allowed on Facebook. As you can see above, four out of the five top comments were made 
by people who believed the deception depicted in the doctored photo — that members of Congress posed in front of 

a painting of Osama Bin Laden and an ISIS flag. Also note that Rep. Omar's face has been photoshopped to darken 

her teeth and the skin around her eyes as a way of exaggerating racist tropes. The meme itself received over 3.5K 
shares and hundreds more reactions and comments. Futhermore, the top comments on the meme received hundreds of 
reactions of their own. Despite countless Americans being exposed to and interacting with this disinformation, it has not 
been taken down by Facebook. 
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CHAPTER NINE 


CHAPTER 9: Russian Hackers Make 
Terroristic Threats Against Military 
Families While Claiming to Be ISIS 


As our servicemembers and their families 
have adopted social media into their 

lives, our foreign adversaries are finding 

new ways to disrupt our military. On 
February 10, 2015, five military wives 
received alarming messages from Facebook 
accounts purporting to be part of the 

“Cyber Caliphate,’ a supposed offshoot of 
ISIS.269 These terroristic threats, which were 
designed to be reported on and cause a sense 
of panic in the military community, were not 
from jihadists — but from the same Russian 
IRA that interfered with the 2016 election. 


The IRA's targets were not chosen at random: 
They were five women with prominent 
voices in the community, whom the hackers 
knew had public platforms from which they 
could amplify news about the threatening 
messages. The IRA’s plan worked, with the 
women writing firsthand accounts of the 
messages,”°! taking to print media,?® and 
doing on-camera interviews for popular 
stations such as FOX News.?6? 


This “false flag” operation exposed millions 
of Americans to the narrative that ISIS was 
tracking down and hunting military families 
and caused a wave of panic. 


This coordinated series of terroristic threats 
followed the hacking of Central Command's 
Twitter account; the hack was used to post 
threatening messages to military families.?® 
All five women who received the IRA 
messages had been quoted in a CNN story on 
the hack,?© expressing their concerns about 
the safety of military families.?® 


These events coincided with a massive 
hacking campaign that was attributed to APT 
28, also known as Fancy Bear — the Russian 
hacker group at the IRA — as detailed by the 
digital-security-firm Secureworks in a threat- 
analysis report published in June 2016.7 
Digital signatures from this Russian entity 
overlap so often with the Cyber Caliphate 
that they have been deemed to be one and 
the same.” Secureworks’ Counter Threat 
Unit researchers have found that APT 28 was 
responsible for a spear-phishing (sending 


emails from an ostensibly trusted source to 
solicit confidential information) campaign 
that targeted more than 1,800 Gmail 
accounts, a plurality of which were then 
current or former US military personnel.?°? 
This report found that military spouses 
who wrote about the military and military 
families made up nearly a quarter of the 
journalists who were targeted by APT 28 
during the spear-phishing campaign. 
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CHAPTER 10: Suspicious Accounts 
Purporting to Work for Reputable 
MilVet-Focused Organizations 


Foreign entities’ imitation accounts that 
target MilVets are not limited to creating 
fraudulent accounts and pages made to look 
like they represent MilVet organizations but 
also to look like the individual MilVets who 
work for and represent these organizations. 
By claiming employment or afhliation with 
MilVet organizations, these fake accounts 
are able to gain the trust of the broader 
MilVet community and connect directly with 
influential MilVet advocates who do in fact 
represent and work with these organizations. 


Microsoft's career-focused social-media 
network for professionals, LinkedIn, has 
been used by Chinese spies to gain access 

to our law-enforcement and intelligence 
communities, and to recruit Americans who 
have access to government and commercial 
secrets.?”° LinkedIn served as a gateway for 
China to recruit an Army veteran and ex- 
CIA officer, Kevin Mallory, by exploiting his 
debt and career trouble.” There has been 
some correlation between those targeted on 
LinkedIn and victims of the 2015 OPM data 
breach, which compromised the personal 
information of 22 million Americans who 
sought security clearances. 


Considering all the data garnered — 

such as the private information China 
obtained via the OPM data breach, the 

career information that individuals post to 
LinkedIn, and the more personal life-updates 
that people post to Facebook and Twitter — 
foreign intelligence services have endless 
opportunities to spot, assess, develop, recruit, 
and handle potential spies.?” 


Fake Veterans Advantage 
Employee: “Richard Gordon” 


An entity using the alias “Richard Gordon” 
on Facebook has targeted and infiltrated the 
community of veteran advocates. The profile 
uses a blurry photograph of a Vietnam-era 
veteran as a profile photo. The biography 
claims Richard Gordon holds the position 
of art director at Veterans Advantage, a 
popular veteran-owned business (Figure 
248).?”? Scott Higgins, the CEO of Veterans 
Advantage, states he doesn’t know of and 
never employed a Richard Gordon. 


The Richard Gordon profile appears to have 
been created on or around March 17, 2017, 
using two generic veteran-themed images to 
establish its profile and background photos. 
From the date of creation through October 
6, 2017, the account itself was dormant, 
though it was tagged by other accounts in 
posts related to Putin, Hillary Clinton, and 
Trump with scores of other veteran-focused 
accounts. On October 7, 2017, the Richard 
Gordon account became active, posting daily, 
with links to veteran-related merchandise 
and memes, including many known to have 
been generated by the Russian IRA. 


The Richard Gordon account’s friend 

list rapidly grew and now has over 2,200 
connections. Almost all these Facebook 
friends appear to be veterans — with most of 
them being white, male, and of the Vietnam 
generation. While a few of these accounts 
look to be inauthentic, the vast majority are 
real veterans. At least five of the account's 
friends are prominent veteran advocates, 
including VVA’s own executive director. 


The account appears to be 

coordinating with at least two other 
inauthentic accounts — one that is veteran- 
focused, and one that is entirely focused 

on Freemasons. All three of these accounts 
are admins for the 2,8300-plus-member 
Facebook group called “Veterans pride shop,” 
which was created on November 16, 2016.24 
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Figure 248: “Richard Gordon” Facebook profile, which claims to be of the art director at Veterans Advantage and is 
connected with at least five well-known MilVet advocates. 
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The purpose of this account and its network 
is unclear. We do not know where the money 
obtained from sales of merchandise goes 

to — or whether the intent of the Russian 
propaganda that the account posts is to boost 
sales or whether it’s to sow division, as it 

was for the propaganda’s original sources. 
Whatever the mission is of the person behind 
the Richard Gordon account, it provides an 
example of how easily an inauthentic account 
can infiltrate the veterans community and 
continue to spread Russian-generated, 
politically divisive content. 


The Richard Gordon profile shared an 
image that prominently features a VVA 
flag waving?” alongside over a dozen 
Russian-developed propaganda memes 
with at least three different Russian- 


created MilVet-focused accounts and 
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CONCLUSION 


What you see in this report is a mere fraction 
of the thousands of pieces of evidence 
documenting inauthentic and predatory 
activity that we have collected over the past 
two years. We could not possibly cover all 
that we have found in a single document, 

but we want to briefly go over some of our 
findings that we haven't highlighted in this 
report. 


e We have discovered a bot network of 
Facebook accounts originating from the 
Republic of Georgia that were at times 
activated by posts that tagged the official 
Facebook pages of Donald J. Trump and 
Hillary Clinton. Within five seconds of a 
user posting news about either politician, 
these bots would swarm the post, quickly 
leaving comments with links to websites 
with sensationalized political news. 

While these bots appear to have gone 
dormant, they remain online and may 
reactivate to sow confusion and discord 
in our democracy in the future. One of 
the earliest among a series of websites 
promoted by these bot accounts was 
linked to a Twitter account that had its 
location listed as Russia. 

e We have been tracking a Twitter bot 
network that is targeting servicemembers, 
veterans, and veterans advocates. Some 
of the bots in the network are using VSO 
logos as their profile photos and others 
are primarily commercially oriented. 
They retweet official federal government 
accounts, veterans organizations, and 
political organizations, like the National 
Rifle Association, in order to blend 
in with the veterans community and 
promote evergreen content (content that 
is always relevant) that is appealing to the 
target audience. These twitter bots are 
promoting websites connected to overseas 
and domestic IP addresses, as well as 
cloud-hosting services (some of which are 
known malware-distribution points). This 
malware includes “command and control” 
scripts, which makes the personal devices 
of unsuspecting internet users part of the 
infrastructure of the bot network itself. 
Malware associated with these networks 
also includes ransomware, which can lock 
down people’s computers — and allow 
hackers to extort them. It also includes 
spyware such as persistent cookies, which 


can be used to both monitor a victim’s 
online activity and to scrape passwords 
by recording keystrokes. Elements of 

this network also appear to be hosted 

on servers that, based on the associated 
URLs, are afhliated with websites 
reported to contain child pornography, 
though it would not be appropriate for us 
to investigate that further. 

e We have found networks of Facebook 
pages that have left automated comments 
on one another’s posts as a way of 
artificially boosting engagement metrics 
and to build audiences. 

e We have found social-media presences 
that purport to be dating services 
exclusive to American servicemembers 
and veterans but are operated from 
Ukraine. 

e As recently as 2018 we found Facebook 
pages openly advertising nude 
photographs of servicemembers. 

¢ Several nationally recognized veterans 
organizations have reported to us that 
their email sign-up websites have been 
targeted by swarms of inauthentic 
submissions, and/or they have had their 
websites attacked. This includes an 
instance of a hacking group taking over 
a veterans organization's website while 
claiming to be part of a jihadist group. 

e Since publicly disclosing this 
investigation, I — the investigator and 
author of this report — have received 
targeted phishing emails with hyperlinks 
that route through IP addresses located in 
Russia and China. 


Vietnam Veterans of America will continue 
this investigation for as long as we have 

to, but we hope that law enforcement, 
intelligence agencies, and congressional 
investigators will take the lead from here. 


Servicemembers, veterans, and our families 
are being targeted both by foreign criminals 
and our nation’s adversaries as a direct result 
of our service and sacrifice. We have had 

our identities stolen and our organizations 
imitated so that we can be politically 
exploited and manipulated by foreign powers 
on a mission to destroy the very democracy 
we fight for. 


These attacks will continue until policies are 
enacted to quickly and harshly impose a real 
cost on bad actors so that they are dissuaded 
from engaging in and being complicit in 
predatory behavior online. It is not enough 
to simply rely on social-media companies 
closing the accounts of people engaged in 
fraud. These predators can too easily create 
new accounts and continue taking advantage 
of and manipulating Americans. The 
provocateurs behind the anonymous avatars 
must pay a price and be brought to justice. 


The White House must recognize that 
cybersecurity is national security, and our 
virtual borders are far more porous and 
pose much greater dangers than our physical 
borders. The Department of Veterans Affairs 
must modernize and consider cyber-hygiene 
an important aspect of veterans’ overall 
well-being. Internet-based companies must 
do more to educate and protect their users. 
Congress must pass laws that maintain 
Americans’ First Amendment rights while 
removing foreign influence from our 
democracy. 


An organization composed of women and 
men in their retirement years should not 
have to advocate for these changes. But we 
remember our founding principle: Never 
again will one generation of veterans abandon 
another. VVA will keep fighting for as long as 
any veteran is at risk of abuse. 
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RECOMMENDED ACTION 
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White House 


The aforementioned cyber-threats against 
American troops and veterans culminate 

in a serious national-security issue that will 
get worse as our adversaries advance their 
TTPs and technologies. As Commander- 
in-Chief, the President bears the ultimate 
responsibility to coordinate a response to 
persistent cyber-threats against American 
troops and veterans. Through the executive 
powers granted to the President by the 
Constitution, by law, and by precedent, the 
President can take swift action to address this 
growing crisis by issuing an Executive Order 
(EO). 


Issue an Executive Order to 
Protect Troops and Veterans 
From Exploitation by Foreign 
Actors and to Strengthen 
American Cybersecurity 


The President should immediately issue an 
EO for the purpose of focusing the attention 
of the concerned federal agencies and the 
American public on the problem of foreign 
elements persistently targeting American 
troops and veterans in cyber-environments. 
An EO would not only mobilize government 
resources, it would also be an opportunity 
for the President to leverage the office to 
elevate the issue?®? and begin a critical public- 
awareness campaign that is designed to 
strengthen vulnerable targets. 


Create a Cybersecurity 
Agency, Appoint a Secretary of 
Cybersecurity 


The increasing role of the internet in 

the lives of everyday Americans and its 
importance to the economy necessitates 
the establishment of a new department 
dedicated to cybersecurity. In 1930, with 
over four-million Americans having served 
in World War I, President Herbert Hoover 
recognized that the existing Veterans Bureau 
was not sufficient and signed Executive 
Order 5398 transforming the Veterans 
Bureau into the Veterans Administration, 
raising it to the level of a federal agency. In 
1988, President Ronald Reagan recognized 
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that with millions of American veterans of 
WWI, WW23, and the Korean and Vietnam 
wars depending on government services, the 
Veterans Administration needed to again be 
elevated. President George Bush explained 
the justification, saying “There is only one 
place for the Veterans of America, in the 
Cabinet Room, at the table with the President 
of the United States of America.’2%° Thus, 

the Veterans Administration became the 
Department of Veterans Affairs. 


The fact that the internet is so ingrained in 
government, the economy, and the lives of 
all Americans makes clear that it is necessary 
to elevate the massive undertaking of 
American cybersecurity to the Cabinet level. 


The role of Cybersecurity Coordinator 

was created by the Obama White House in 
2008 as a modernization effort and for the 
purpose of “harmonizing government policy 
on cybersecurity and digital warfare.”??! On 
May 1, 2018, then-National Security Advisor 
(NSA) John Bolton?” reportedly eliminated 
the position of Cybersecurity Coordinator 
on the National Security Council (NSC).?% 
The purpose of this position had been to lead 
national efforts to ensure that Americans and 
our government were protected from ever- 
advancing cyber-threats.?%* The President 
should use the proposed EO to immediately 
reestablish and make permanent the role 

of Cybersecurity Coordinator on the NSC, 
and retitle the position as Secretary of 
Cybersecurity. 


For the purposes of reporting to the 
President and in terms of rank in 
government, the Secretary of Cybersecurity 
should be considered a Cabinet-level 
position. 


The National Cybersecurity Division — 
which currently exists as a division of the 
Office of Cybersecurity & Communications 
within the United States Department of 
Homeland Security’s Directorate for National 
Protection and Programs?*> — should be 
made an autonomous department within 
the federal government and be renamed the 
Department of Cybersecurity. The Secretary 
of Cybersecurity would lead this new agency. 
This would ensure that America’s chief 
cybersecurity coordinator has minimal 
barriers?** to accessing the President. With 
the EO establishing rank and departmental 
autonomy this way, the Secretary of 


167 


168 


Cybersecurity would become a culturally 
recognized and appreciated position within 
the Executive Branch.?9” 


The EO should empower the Secretary 

of Cybersecurity to convene, share best 
practices among, and direct the necessary 
activities of the chief information officers 
(CIOs) and chief information security 
officers (CISOs) of every federal agency and 
department. The EO should also make the 
director of Cybersecurity the chair of the 
CIO Council.?%8 Additionally, the EO should 
standardize the practice of CIOs and CISOs 
in every department and agency having 
deputy-secretary-level positions, reporting 
directly to the chief executive at their 
respective departments and agencies. 


The Secretary of Cybersecurity would 

work closely with US Cyber Command 
(CYBERCOM), the Central Intelligence 
Agency (CIA), the Federal Bureau of 
Investigation (FBI), and the National Security 
Agency (NSA)?°? to ensure that all nefarious 
activities in cyber-environments by foreign 
and domestic actors are detected, disrupted, 
and when appropriate prosecuted in 
accordance with the law or dealt with harshly 
and swiftly in accordance with the laws of 
armed conflict. 


CYBERCOM, the NSA, and the CIA were 
recently granted expanded authorities under 
the classified document known as “National 
Security Presidential Memorandum (NSPM) 
138."°09 The National Defense Authorization 
Act (NDAA) for 2019 also clarified 
CYBERCOM'’s role in engaging foreign 
adversaries.*”! Together, these recent changes 
allow CYBERCOM to maintain a “defense 
forward” posture against state 

actors — specifically Iran, Russia, China, and 
North Korea. 


CYBERCOM's primary focus in this area 
would remain on activities by hostile state- 
sponsored actors, and the NSA would keep 
its role as an intelligence agency within 

the DoD. The FBI will remain charged 

with the investigation and prosecution of 
criminal cyber-activity.®°? The Department 
of Cybersecurity will focus on the detection 
and disruption of foreign and domestic non- 
state actors who attempt to exploit American 
government, infrastructure, commercial 
entities, and civilians in cyber-environments. 
If necessary, NSPM 13 should be amended 


to allow the Department of Cybersecurity to 
maintain a defense-forward posture against 
non-state actors. 


The Secretary of Cybersecurity should 
maintain a 10-year term, in following with 
the precedent of the position of the FBI 
director as prescribed by Section 208 of the 
Crime Control Act of 1976.2? This tenure 
would both insulate the Secretary from 
political influence by the Presidents under 
which they serve®™ and allow the nation to 
benefit from steady, consistent, non-political 
leadership at the helm of the proposed 
Department of Cybersecurity. 


Engaging the Private Sector 


Through the EO, the President should 
create a “Civilian Cybersecurity Advisory 
Board” consisting of CISOs from major US 
social-media, cybersecurity, and internet 
firms. This advisory board would work with 
the Secretary of Cybersecurity to promote 
seamless private-public partnerships for 
the betterment of US cybersecurity, and 

to promote the timely exchange of best- 
practices and knowledge of threats among 
private entities. 


Work with Social-Media Companies 
to Verify Claimed MilVet Affiliation of 
Users/Accounts 


Both individual and state-sponsored 

foreign cybercriminals have been using fake 
accounts with imitation MilVet identities and 
afhliations on social media to manipulate 
MilVets and the general public. As an 
incentive to fix this problem, continued 
membership on the President’s Civilian 
Cybersecurity Advisory Board should be 
contingent after a period of one year on 

the basis of whether or not the concerned 
tech firms have implemented policies to 
verify claimed military service by users of 
their platform. Members should also be 
responsible for verifying that claimed MilVet 
organizations that utilize their platforms are 
in good standing with the IRS.°” 


Ensure Internet Companies Maintain 
Evidence of All Suspected Cybercrimes 


Members on the Civilian Cybersecurity 
Advisory Board must also maintain 
evidence of and report all cybercrimes and 
propaganda campaigns suspected to have 
been committed against Americans by 
foreign entities. 


Appoint a Deputy Assistant 
Secretary of Cyber-Health, 
Direct VA to Consider 
Cyber-Hygiene a Critical Aspect 
of Veteran Wellness 


Our adversaries are engaging in a form 

of psychological warfare when targeting 
veterans with deceptive online content. The 
falsified news that foreigners have directed 

at veterans includes stories about veterans’ 
benefits being cut, which is meant to make 
veterans feel financially insecure and provoke 
outrage.°°° This type of psychological 
manipulation could potentially exacerbate 
veterans service-related conditions such as 
PTSD or depression. Studies have shown that 
chronic psychological distress can increase 

a person's likelihood of worsening physical 
health conditions such as cardiovascular 
disease, diabetes, and stroke.° 


For these reasons, VA must recognize the 
impact of cyber-threats on veterans’ health 
and make efforts to inoculate veterans against 
cybercrime through training, education, and 
the distribution of information. 


The President should use the EO to instruct 
the VA to develop programs dedicated to 
improving veterans cyber-hygiene®®’ and to 
recognize the maintenance of cyber-hygiene 
as anecessary aspect of healthy living for 
veterans in the 2lst century and beyond. 

In order to accomplish this, a new position 
would be created within VA: a Deputy 
Assistant Secretary of Cyber-Health, who 
would report directly to the VA department's 
Under Secretary for Health. 
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Preventive Measures: Lifetime 
Identity- Theft Insurance and 
Credit-Monitoring for All Troops 
and Veterans 


After the OPM data breach was discovered 

in 2015, OPM and DoD quickly responded 
by announcing an 18-month contract to 
provide identity-theft insurance and credit- 
monitoring for the 22-million affected 
Americans.®°° This executive action was 
necessary so that the government could 
provide immediate reassurance to victims of 
the hack and take steps to minimize potential 
damage should the data be used for nefarious 
purposes. 


Congress then expanded this benefit through 
2026 with section 688 of the Consolidated 
Appropriations Act of 2017, Public Law No. 
115-31.2!° While the funding for this insurance 
is currently set to expire, the information 
obtained by APT (advanced persistent threat) 
Deep Panda will remain a looming danger 
throughout the lifetime of all victims whose 
data was exposed. 


In recognition of the pervasive and persistent 
targeting and threats against MilVets in 
cyber-environments, the President should 
use the precedent set in 2015 and this 
proposed EO to expand the program to all 
current troops and veterans. Perhaps most 
importantly, the President should work with 
Congress to make this a permanent program, 
as even a temporary lapse could expose 
millions of MilVets to serious vulnerabilities. 


Offer Complimentary Antivirus 
Software to All MilVets 


While identity-theft insurance and credit- 
monitoring services are vital, prevention 
must be a key element of this EO. Antivirus 
software and secure password managers 
should be protecting all MilVets both from 
individualized targeting and worldwide 
malware campaigns not only on government 
systems, but on their personal electronic 
devices as well. The President should 
direct the Secretary of Defense, Secretary 
of Veterans Affairs, and Secretary of 
Cybersecurity 
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to come up with a plan to issue 
complimentary antivirus software and secure 
password managers to all MilVets within a 
year of the issuance of the EO. 


The intended effects of these preventive 
measures would be multifold. First, securing 
the personal electronic devices of all MilVets 
will reduce the likelihood of identity theft. 
Decreased incidents of identity theft will 
reduce the rate of claims for identity-theft 
insurance, thus also reducing the cost of 
maintaining the lifetime identity-theft 
insurance program. Second, increased 
personal electronic security will make troops 
less likely to face cyber-intrusions that 
could compromise their security clearances 
and military readiness. Third, the public 
knowledge that MilVets and their personal 
devices are protected by antivirus software 
will make the community as a whole a less- 
attractive target for our cyber-adversaries. 
Even if attacks on individuals are successful, 
antivirus software and password managers 
will effectively create a cyber-herd-immunity 
that would decrease the risk of the spread of 
malware from MilVet to MilVet. 


The government should seek to develop 
contracts with a diverse set of cybersecurity 
software providers and offer multiple options 
to MilVets regarding which free software 

to utilize for personal internet-connected 
devices. A diverse set of security-software 
options for MilVets to opt into would 

reduce the likelihood that a single zero- 

day vulnerability (a software vulnerability 
without a fix in place) would be shared across 
the entire population. 


Department of 
Veterans Affairs 


In recognition of the fact that in the 21st 
century the internet and electronic devices 
are an increasingly important part of 
veterans lives, the Secretary of Veterans 
Affairs should appoint a Deputy Assistant 
Secretary of Cyber-Health (as mentioned 
above in Chapter 1), who would be charged 
with efforts to improve cyber-hygiene for 
veterans. 


The Secretary of Veterans Affairs and 
the proposed Deputy Assistant Secretary 


of Cyber-Health should immediately 
commission studies to determine the impacts 
on physical and mental health, financial 
stability, and general well-being of veterans 
who have fallen victim to cybercrime. 


The Department of Veterans Affairs should 
solicit proposals from cybersecurity firms 

on how to best protect veterans in cyber- 
environments. Proposals should include 

the types of complimentary antivirus and 
security software that the VA should offer 
veterans, employees, contractors, and private 
healthcare providers who handle veterans’ 
records as a result of the MISSION Act and 
similar “Choice’-related programs. 


Department of 
Defense 


Working Group to Study 
Security Risks of Personal 
Devices Used by Troops 


Global positioning systems (GPS-connected 
devices), dating apps, and social-media 
accounts, cameras on internet-connected 
devices, the use of private email, and other 
common apps all contain potential threats 
to the safety and security of our Armed 
Services. 


The EO should direct the Secretary of 
Defense to create a working group to study 
risks presented by the use of common 
personal electronic devices and apps both in 
the field and at home. 


On January 29, 2018, the New York Times 
revealed that the “Strava Fitness” running 
app revealed the locations and perimeters of 
forward-operating bases — including secret 
and sensitive locations — in Niger, Syria, 
Iraq, Afghanistan, and other countries.*! 
Strava connects to common workout 
trackers, such as Fitbit, so that users can 
map and track their exercise. These workout 
trackers have been issued by the military to 
encourage healthy lifestyles and wellness — 
yet they present the unexpected danger of 
revealing covert operations. 


This working group should be tasked with 
proposing new standards on a yearly basis 


(since apps and their risks are constantly 
evolving) for authorized and approved 
devices, as well as appropriate restrictions for 
use. 


Once new standards are developed, training 
and enforcement should be integrated into 
regular health-and-welfare instructions for 
troops. 


Department of State 


Foreign-Policy Focus: Instruct 
State Department to Make 
Cybercrime Apprehensions a 
Priority in Foreign Nations 


Through the EO, the President should 
posture the United States in a way 

that encourages the development and 
enforcement of anti-cybercrime laws abroad, 
while promoting the protection of the 
individual rights and freedoms of people 
around the world. The Secretary of State 
should prioritize negotiations supporting 
these laws and values when dealing with 
allies and adversaries alike. Through its 
Office of Economic Sanctions Policy and 
Implementation,?” the State Department 
should develop sanctions for countries 

that refuse to fight cybercrime within 

their borders or engage in state-sponsored 
cybercrime. These sanctions should be aimed 
at reducing internet access for criminals 
within the country concerned by creating 
barriers to consumer products, technologies, 
and services that are commonly exploited for 
cybercrimes. 


Department of 
Justice 


Ensure that Internet Companies 
Maintain Evidence 


The President should through the EO direct 
the Justice Department to order social-media 
and related companies to immediately 
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begin preserving all data that is likely to 

be considered evidence of foreign entities 
attempting to deceive Americans for the 
purpose of: financial fraud; the imitation of 
American organizations or commission of 
identity theft of US persons; or to illegally 
influence political matters or participate in 
disinformation campaigns. The Department 
of Justice should issue a regulation 
mandating the reporting and submission of 
such evidence. In order to make this policy 
permanent, the President should work with 
Congress to amend internet privacy laws. 


Congress 


Congress should update laws regarding 
internet privacy and fraud protections, and 
grant law enforcement the jurisdiction to 
respond to and prevent cybercrimes. 


Congress should guarantee that law 
enforcement has the personnel, authorities, 
and funding required to prioritize 
interdiction of networks of foreign 
cybercriminals who target Americans for 
financial fraud. Congress must ensure that 
all evidence of cybercrimes and foreign 
disinformation campaigns is preserved 

and that statutes of limitation are extended 
appropriately so that law enforcement and 
independent researchers can ensure that 
victims can see their perpetrators brought to 
justice. 


Congress must create a statutory “duty to 
disclose” for internet companies to alert users 
when they have been exposed to content or 
accounts that are known to have been part of 
a coordinated disinformation campaign. 


Congress must hold accountable the 
internet registrars and web-hosts who 
allow cybercriminals to anonymously 
create predatory websites — including but 
not limited to those who host malware; 
those who facilitate sales of counterfeit 
merchandise; and those who host foreign- 
born disinformation campaigns. 


Congress should also hold accountable 
Western Union, PayPal, and other companies 
that facilitate financial fraud. 


Congress should through legislation 
authorize the creation of the Department 
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of Cybersecurity and the appointment 

of a Secretary of Cybersecurity. This 
department should be empowered to act 

in all appropriate matters of intelligence, 
defense, and law enforcement. As such, 

this department and its Secretary would be 
accountable to the Senate Select Committee 
on Intelligence, the Senate Committee on 
Armed Services, and the Senate Committee 
on the Judiciary, as well as the House 
Committees on Energy and Commerce, 
Armed Services, Intelligence, and the 
Judiciary. Congress should legislate a 10-year 
term for the Secretary of this department, 
and confirmation must require a two- 

thirds majority vote, as a way of ensuring 
nonpartisan service in the position. 


Committees on Veterans’ 
Affairs 


Commission Study 


The Senate and House Committees on 
Veterans Affairs should commission studies 
on the physical and mental-health effects of 
cybercrimes and propaganda campaigns that 
are directed at veterans. The Committees 
should pass legislation to aid veterans 

who have fallen victim to cybercrime. The 
Committees must pass legislation to ensure 
that the Department of Veterans Affairs 
prioritizes cyber-hygiene of veterans and 
makes cyber-health a priority. 


Pass a Law to Grant Lifetime Identity- 
Theft Insurance and Credit-Monitoring 
for All Veterans and Dependents 


In recognition of the fact that military 
service increases the likelihood of targeting 
by cybercriminals and hostile nation states, 
the Committees on Veterans’ Affairs should 
empower the VA to grant lifetime services 
of free identity-theft insurance and credit- 
monitoring to veterans and their families. 


VA to Consider Cyber-Hygiene a Health 
Need 


The Committees on Veterans’ Affairs must 
instruct the VA to develop programs that 
recognize cyber-hygiene as a critical aspect 
of veterans’ health and well-being. In order to 
facilitate this modernization, the Committees 
on Veterans Affairs should legislate the 
creation of the position of Deputy Assistant 
Secretary of Cyber-Health, who would be 
charged with the mission of ensuring that 
veterans have the services and support that 

is required to maintain appropriate cyber- 
hygiene. 


Require VA to Offer Complimentary 
Antivirus Software to All Veterans and 
Dependents 


In order to protect veterans from becoming 
victims of cybercrime and targeting by 
hostile groups, the Committees on Veterans’ 
Affairs should require the VA to contract 
services from a variety of American cyber- 
security companies, so that the VA can offer 
to veterans and their families their choice 

of the complimentary antivirus software. 

To ensure that cybersecurity services and 
products offered remain effective, the VA 
should ensure that a diverse set of options 
are available for veterans and their families 
to choose from, so that one contractors’ zero- 
day vulnerability would not impact the entire 
system at once. 


Committees on Armed 
Services 


The Senate and House Committees on 
Armed Services must commission studies 

to evaluate the risk to force readiness 
presented by cybercrime and foreign- 

born propaganda campaigns, determine 

how many servicemembers have already 
been impacted, and what security risks 

are presented by servicemembers’ use of 
personal devices and apps at home and 
abroad. The Committees should pass 
legislation to expand to all servicemembers 
and their families and make permanent 
lifetime credit-monitoring and identity-theft 
insurance. This legislation should instruct the 
Department of Defense to make the personal 
cyber-health of servicemembers a priority, 
and require training in cyber-hygiene. The 


Committees should also pass legislation to 
offer complimentary antivirus software to all 
servicemembers and their families. Specifics 
follow below. 


Commission Study 


Studies should focus on answering the 
following: How many troops and families 
fall victim to romance scams or similar 
cybercrimes? What are the readiness risks 
associated with being a victim of said 
cybercrimes? What are the security risks of 
personal devices and apps used by troops? 


Offer Lifetime Identity- Theft Insurance 
and Credit-Monitoring for All Troops 


In recognition of the fact that military 
service increases the likelihood of targeting 
by cybercriminals and hostile nation states, 
the Committees on Armed Services should 
require the DoD to grant lifetime services of 
free identity-theft insurance and 
credit-monitoring to veterans and their 
families. 


DoD Must Consider Cyber-Hygiene a 
Health Need, Mandatory Training 


The Committees on Armed Services must 
instruct the DoD to develop programs that 
recognize cyber-hygiene as a critical aspect 
of servicemembers’ health and well-being. In 
the next National Defense Authorization Act 
(NDAA), the Committees on Armed Services 
must include language that requires military 
commanders to perform regular cyber- 
hygiene checks as part of their traditional 
health-and-welfare inspections within their 
respective units. 


Offer Complimentary Antivirus Software 
to All Troops 


The Committees on Armed Services must 
ensure that all personal electronic devices 
used by American servicemembers at home 
and abroad are operating at the highest 
levels of security. The Committees on Armed 
Services should require the Department of 
Defense to provide complimentary antivirus 
software to all servicemembers for use on 
their personal electronic devices. 
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Social-Media and 
Internet Companies 


General (all companies) 


Social-media companies have borne the 
brunt of controversies related to the election 
interference, financial scams, and political 
division that they have facilitated, and for 
good reason. Social-media companies, 
however, are among the victims of these 
hostile foreign entities as well. They must 
enact reforms to ensure the security of their 
users. 


Social-media companies should maintain all 
evidence of foreign interference — not just 
remove it from their platform and delete the 
offending content. Social-media companies 
should create public repositories of known 
propaganda so that the public can learn 
what disinformation looks like. Confirmed 
propaganda should be watermarked in these 
public repositories to reduce the risk of 
recirculation and reuse. 


Social-media companies must proactively 
screen military- and veteran-focused 
accounts, groups, and pages for inauthentic 
behavior. These companies, particularly 
career-focused social-media platforms such 
as LinkedIn, must verify military service of 
those who claim it — perhaps with a new, 
green checkmark or verification badge — 
or they should include a clear warning for 
claimed but unverified military status. 


Alternatively, these platforms should not 

let military affiliation or veteran status be 
made visible to other users unless it has been 
internally verified. 


Social media shouldn't simply rely on 
reporting by users. They should be proactive 
in hunting for criminals who are abusing 
these platforms, collect evidence, and report 
criminal activity to law enforcement. 


Social-media companies should empower 
reliable troll hunters with tools and special 
permission to assist them in their work, 

as well as amply compensate individuals 
and organizations who frequently produce 
reliable reporting. 
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Social-media companies must ensure that 
link-shorteners cannot be used to circumvent 
bans on dangerous websites or to disguise 
websites that users may otherwise know to 
avoid. 


Social-media companies should create a 
joint-company threat intelligence committee, 
backed by a publicly funded non-profit as a 
facilitator. 


Self-regulation is a critical step: Develop a 
company culture that includes a duty-to- 
disclose when users have been directly or 
indirectly impacted by inauthentic behavior. 
If a Facebook friend, a Twitter follower, 

or other connected social-media account 

is removed for abusive, predatory, or 
inauthentic behavior, the company should 
inform the people who have interacted with 
that account about the removal. 


When inauthentic or fraudulent activity is 
discovered on an account that has affiliated 
accounts on other social-media platforms, 
social-media companies must also alert one 
another. 


Facebook / Instagram 


Include locations of all current and past 
admins in page history — make country of 
origin more prominent so that average users 
can see it without requiring a click-through. 


Use artificial-intelligence (AI) tools to scan for 
confirmed political propaganda of Russian/ 
foreign origin and notify users/pages that 
they have interacted with that propaganda. 
Also, when propaganda is discovered, it 
should be watermarked to help educate users 
to identify foreign-influence campaigns. 


Develop AI to detect romance scammers — 
especially search for suspicious connections 
between military-afhliated West Africa 

users and Americans; look for repeated 

use of identical text, which is a hallmark of 
scammers, who buy, sell, and trade prepared 
scripts. 


Scammers often claim to work at Facebook 
in their Facebook profiles. Facebook should 
not allow any non-employee to falsely claim 
employment by Facebook on their platform; 
furthermore, Facebook should verify users 
who claim to be employees. 


Similarly, if people claim military service in 
their bio or work history, Facebook should 
verify it before allowing that information to 
be viewed publicly. 


Facebook should scan posts for unauthorized 
use of names and trademarks of veterans 
service organizations and record these 
incidents, as well as provide evidence of 
fraudulent activity to law enforcement. 
Facebook should also notify victims of these 
incidents. 


Facebook should form a partnership with 
LinkedIn and use facial-recognition software 
across platforms to detect and disrupt 
imitation accounts. Notify users who are 
being imitated. 


Twitter 


Twitter must proactively seek out and verify 
legitimate military and veterans advocates 
and organizations. 


Twitter must study and disrupt attempts by 
foreign entities to infiltrate and influence the 
American military and veterans community. 


Twitter should scan posts for unauthorized 
use of names and trademarks of veterans 
service organizations and record these 
incidents, as well as provide evidence of 
fraudulent activity to law enforcement. 
Twitter should also notify victims of these 
incidents. 


LinkedIn 


LinkedIn should verify claimed military and 

intelligence afhliations before allowing them 

to be claimed as work experience by users on 
their profiles. 


LinkedIn should form partnerships with 
Facebook and Instagram and use facial- 
recognition software across platforms to 
detect and disrupt imitation accounts, as well 
as notify users who are being imitated. 


Amazon 


Amazon should scan photos of items listed 
for sale to detect illegal use of trademarked 
names and logos of military and veterans 
service organizations. Incidents of illegal 
use of trademarks must be recorded and 
provided to law enforcement. Amazon 


should also notify victims of these incidents. 
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APPENDIX 1 


APPENDIX 1: Facebook Primer 


A person's Facebook profile is the core of their user experience — it’s what they use to upload photos, 
create albums, send and accept friend requests, and post updates about their lives so that they can 
remain connected with friends and family across the globe. Profiles are meant to be personal. 


Pages, on the other hand, are akin to a digital storefront, complete with online stores and customer- 
service messaging. Facebook pages were designed so that companies, public officials, and groups 
could communicate more easily with their customers, constituents, or members — while being able to 
control and project their brand’s image. 


Facebook pages can be viewed by any Facebook user (unless they are individually banned or blocked), 
whereas Facebook profiles can be set with restrictive privacy settings according to the preference of 
the individual. Facebook users can leave comments on most status updates, photos, and links posted 
by pages — and leave detailed reviews for the page and the brand it represents. Facebook users can 
also share anything posted by pages onto their own timeline, so that the individual users’ friends and 
followers can see them. 


Pages don't necessarily have to represent a real-world entity. Pages can also be parodies or unofficial 
fan clubs, or a tool to aggregate and disseminate information and news about any topic of interest. Any 
Facebook user can create and be an administrator (aka admin) for a page and can authorize and assign 
other Facebook users administrator privileges to help manage the page. 


Facebook groups are similar to pages in that they are “owned” and moderated by a controlled set of 
admins, but they're designed in a way that usually allows any member to project their voice by posting 
to all other members of the group. Admins can relax settings so that it’s a free-for-all, or they can 
tightly control the group so that posts by members need to be approved before being revealed to the 
entire group. As they can with a page, group admins are able to set the tone of the conversation within 
a group, as well as censor or hide whatever content or comments don't serve their purpose. 


There are three different group types: public, closed, and secret, and admins can control privacy 
settings for the group to the various levels — which presents specific challenges to independent 
investigators that are not associated with the Facebook pages. 


A “closed Facebook group’ is a group that reveals posts only to Facebook users whom the admins 
allow to enter the group. Unlike with Facebook pages, where admins tightly control what appears, 
Facebook groups are designed around the idea of community-led discussion, which allows any 
member to post publicly. Admins and moderators, though, can delete posts and comments within the 
group, shaping discussions as they see fit. 
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Belarus, Bulgaria, Croatia, 
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ENDNOTES 


Please Note: All links to Facebook pages will no longer work once the pages are closed or taken down; tf a page 1s closed or taken 
down and then reinstated, however, the link may again provide access. 
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